Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Potential Shim Database Persistence via Sdbinst.EXE

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Markus NeisCreated Wed Jan 16Updated Wed Dec 06517490a7-115a-48c6-8862-1a481504d5a8windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic3 selectors
detection:
    selection_img:
        - Image|endswith: '\sdbinst.exe'
        - OriginalFileName: 'sdbinst.exe'
    selection_cli:
        CommandLine|contains: '.sdb'
    filter_optional_iis:
        ParentImage|endswith: '\msiexec.exe'
        CommandLine|contains:
            # Expected behavior for IIS Express (e.g. https://www.hybrid-analysis.com/sample/15d4ff941f77f7bdfc9dfb2399b7b952a0a2c860976ef3e835998ff4796e5e91?environmentId=120)
            - ':\Program Files (x86)\IIS Express\iisexpressshim.sdb'
            - ':\Program Files\IIS Express\iisexpressshim.sdb'
    condition: all of selection_* and not 1 of filter_optional_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
mandiant.com
MITRE ATT&CK
Related Rules
SimilarDetectionmedium

Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
517490a7-115a-48c6-8862-1a481504d5a8
Status
test
Level
medium
Type
Detection
Created
Wed Jan 16
Modified
Wed Dec 06
Author
Markus Neis
Path
rules/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml
Raw Tags
attack.persistenceattack.privilege-escalationattack.t1546.011
View on GitHub