Potential Persistence Via Shim Database In Uncommon Location

Title: Potential Persistence Via Shim Database In Uncommon Location
Status: test
Description:Detects the installation of a new shim database where the file is located in a non-default location
References:
  -https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
  -https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
  -https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-01
modified:2023-08-17
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1546.011'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains|all:
      -'\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\'
      -'\DatabasePath'

  filter_main_known_locations:
    Details|contains: ':\Windows\AppPatch\Custom'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high