ATT&CK technique
View on MITRE ATT&CK →
T1546.011
Application Shimming
Privilege EscalationPersistence
11 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Shim Database Installation With Suspicious Parameters | production | 2026-10-09 |
| splunk | Shim Database File Creation | production | 2026-10-09 |
| splunk | Registry Keys for Creating SHIM Databases | production | 2026-10-09 |
| elastic | Potential Application Shimming via Sdbinst | production | 2026-09-18 |
| elastic | Installation of Custom Shim Databases | production | 2026-09-18 |
| sigma | Potential Persistence Via Shim Database Modification | test | 2025-10-22 |
| sigma | Uncommon Extension Shim Database Installation Via Sdbinst.EXE | test | 2024-01-10 |
| sigma | Potential Persistence Via AppCompat RegisterAppRestart Layer | test | 2024-01-01 |
| sigma | Potential Shim Database Persistence via Sdbinst.EXE | test | 2023-12-06 |
| sigma | Suspicious Shim Database Patching Activity | test | 2023-12-06 |
| sigma | Potential Persistence Via Shim Database In Uncommon Location | test | 2023-08-17 |