BIOC
Informational
✕
Shim database registration via Registry
Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
Indicator:
Registry action type = create_registry_key , set_registry_value AND registry key name = *software\microsoft\windows nt\currentversion\appcompatflags\installedsdb* , *software\microsoft\windows nt\currentversion\appcompatflags\custom* Host host os = windows
Preventable: yes