Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Title: Uncommon Extension Shim Database Installation Via Sdbinst.EXE
Status: test
Description:Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
References:
  -https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
  -https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-01
modified:2024-01-10
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1546.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\sdbinst.exe' OriginalFileName:'sdbinst.exe'   filter_main_legit_ext:
    CommandLine|contains: '.sdb'
  filter_main_legit_extensions:
    - CommandLine|endswith:
      - ' -c'
      - ' -f'
      - ' -mm'
      - ' -t'
CommandLine|contains:' -m -bg'   filter_main_null:
    CommandLine: 'None'
  filter_main_empty:
    CommandLine: ''
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium