/
proc_creation_win_sdbinst_shim_persistence.yml
37 lines (37 loc) · 1.35 KB
/
proc_creation_win_sdbinst_shim_persistence.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
title: Potential Shim Database Persistence via Sdbinst.EXE
id: 517490a7-115a-48c6-8862-1a481504d5a8
related:
- id: 18ee686c-38a3-4f65-9f44-48a077141f42
type: similar
status: test
description: |
Detects installation of a new shim using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
references:
- https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
author: Markus Neis
date: 2019/01/16
modified: 2023/12/06
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1546.011
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\sdbinst.exe'
- OriginalFileName: 'sdbinst.exe'
selection_cli:
CommandLine|contains: '.sdb'
filter_optional_iis:
ParentImage|endswith: '\msiexec.exe'
CommandLine|contains:
# Expected behavior for IIS Express (e.g. https://www.hybrid-analysis.com/sample/15d4ff941f77f7bdfc9dfb2399b7b952a0a2c860976ef3e835998ff4796e5e91?environmentId=120)
- ':\Program Files (x86)\IIS Express\iisexpressshim.sdb'
- ':\Program Files\IIS Express\iisexpressshim.sdb'
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium