Suspicious SDB file written to disk by an unsigned process

BIOC Informational

Suspicious SDB file written to disk by an unsigned process

Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.

Module:: Platform Analytics
Agent event type:: File
Category:: Persistence
Status:: Enabled

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)

Indicator:

File action type = create , write AND file name = *.sdb AND file path !=~ [.].[a-zA-Z0-9]{2,3}\.[a-zA-Z0-9]{2,3}$ Process initiated by != libero.exe AND heyex.exe AND avevamarinesample2.1.0.exe AND wmiproviders_2.1.5.6002.exe AND initiator path !=~ Xilinx|Flowlink 5.1|CST Studio Suite 2020|Program Files|wish.*exe AND initiator signature = Unsigned Host host os != linux

Preventable: yes