ShimCache Flush

Title: ShimCache Flush
Status: stable
Description:Detects actions that clear the local ShimCache and remove forensic evidence
References:
  -https://medium.com/@blueteamops/shimcache-flush-89daff28d15e
Author: Florian Roth (Nextron Systems)
Date: 2021-02-01
modified:None
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection1a:
    CommandLine|contains|all:
      -'rundll32'
      -'apphelp.dll'

  selection1b:
    CommandLine|contains:
      -'ShimFlushCache'
      -'#250'

  selection2a:
    CommandLine|contains|all:
      -'rundll32'
      -'kernel32.dll'

  selection2b:
    CommandLine|contains:
      -'BaseFlushAppcompatCache'
      -'#46'

  condition:( selection1a and selection1b ) or ( selection2a and selection2b )
Falsepositives:
  -Unknown
Level: high