FIN7G0046 ↗
Has used application shim databases for persistence.1
tfMITRE ATT&CK sub-technique
Application Shimming T1546.011
sub-technique of T1546 Event Triggered Execution
- Tactics
- Persistence, Privilege Escalation
- Platform
- Windows
- Version
- 1.1
- Created
- 24 January 2020
- Last modified
- 24 October 2025
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. [1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.9
Detection rules73rd pct
Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.Application Shimming MITRE reference T1546.011
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PillowmintS0517 ↗
Has used a malicious shim database to maintain persistence.1
SDBbotS0461 ↗
Has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.1
ShimRatS0444 ↗
Has installed shim databases in the AppPatch folder.1
All 3 software entries for this technique
Offense vs defense T1546.011
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 3
first rule: 2019 Q1Application Shimming detection strategy DET0017
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Application Shimming via sdbinst.exe and Registry Artifacts (Windows)
1 platform
AN0051 · Windows
Correlated modification of AppCompat registry keys and execution of sdbinst.exe to install custom shim databases. Followed by DLL injection via shim behavior into target application processes.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CustomShimPathAllowlist | Filter out known-good .sdb paths in AppPatch\Custom folders |
| TimeWindow | Tunable window for correlating registry modification and sdbinst.exe execution |
| DLLInjectionTarget | Expected target applications or binaries for injected DLLs |
| UserContext | Limit alerting to admin or SYSTEM-context initiated shim installations |
| ShimCommandLinePattern | Expected or benign sdbinst.exe command-line patterns to exclude |
Update SoftwareM1051
Microsoft released an optional patch update - KB3045645 - that will remove the "auto-elevate" flag within the sdbinst.exe. This will prevent use of application shimming to bypass UAC.
User Account ControlM1052
Changing UAC settings to "Always Notify" will give the user more visibility when UAC elevation is requested, however, this option will not be popular among users due to the constant UAC interruptions.
Tests3ExecutorsPowerShell 2 · cmd 1Need elevation3 of 3Have prerequisites1Have cleanup3Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition