Detectionhightest

Suspicious Shim Database Patching Activity

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Tue Aug 01Updated Wed Dec 06bf344fea-d947-4ef4-9192-34d008315d3awindows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\'
        TargetObject|endswith:
            # Note: add other application to increase coverage
            - '\csrss.exe'
            - '\dllhost.exe'
            - '\explorer.exe'
            - '\RuntimeBroker.exe'
            - '\services.exe'
            - '\sihost.exe'
            - '\svchost.exe'
            - '\taskhostw.exe'
            - '\winlogon.exe'
            - '\WmiPrvSe.exe'
    condition: selection