Query: detection rule: Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by
Matching passage: Sigma rule: Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by. Logsource: windows / process_creation. Rule: title: Potential Shim Database Persistence via Sdbinst.EXE id: 517490a7-115a-48c6-8862-1a481504d5a8 related: - id: 18ee686c-38a3-4f65-9f44-48a077141f42 type: similar status: test description: 'Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims ' references: - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence author: Markus Neis date: 2019-01-16 modified: 2023-12-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sdbinst.exe - OriginalFileName: sdbinst.exe selection_cli: CommandLine|contains: .sdb filter_optional_iis: ParentImage|endswith: \msiexec.exe CommandLine|contains: - :\Program Files (x86)\IIS Express\iisexpressshim.sdb - :\Program Files\IIS Express\iisexpressshim.sdb condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity d. Logsource: windows / process_creation. Rule: title: PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' id: 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e related: - id: 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f type: similar status: experimental description: 'Detects the use of PowerShell to execute the ''Set-MpPreference'' cmdlet to configure Windows Defender''s threat severity default action to ''Allow'' (value ''6'') or ''NoAction'' (value ''9''). This is a highly suspicious configuration change that effectively disables Defender''s ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads. ' references: - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952 - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ author: Matt Anderson (Huntress) date: 2025-07-11 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_cmdlet: CommandLine|contains: Set-MpPreference selection_action: CommandLine|contains: - -LowThreatDefaultAction - -ModerateThreatDefaultAction - -HighThreatDefaultAction - -SevereThreatDefaultAction - '-ltdefac ' - '-mtdefac ' - '-htdefac ' - '-stdefac ' selection_value: CommandLine|contains: - Allow - '6' - NoAction - '9' condition: all of selection_* falsepositives: - Highly unlikely level: high