name: Shim Database File Creation
id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33
version: 3
date: '2020-12-08'
author: David Dorsey, Splunk
type: batch
datamodel: []
description: This search looks for shim database files being written to default directories.
  The sdbinst.exe application is used to install shim database files (.sdb). According
  to Microsoft, a shim is a small library that transparently intercepts an API, changes
  the parameters passed, handles the operation itself, or redirects the operation
  elsewhere.
search: '| tstats `security_content_summariesonly` count values(Filesystem.action)
  values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path  min(_time)
  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom*
  by Filesystem.file_name Filesystem.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
  |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`'
how_to_implement: You must be ingesting data that records the filesystem activity
  from your hosts to populate the Endpoint file-system data model node. If you are
  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
  you want to collect data.
known_false_positives: Because legitimate shim files are created and used all the
  time, this event, in itself, is not suspicious. However, if there are other correlating
  events, it may warrant further investigation.
references: []
tags:
  analytic_story:
  - Windows Persistence Techniques
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1546.011
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Filesystem.file_hash
  - Filesystem.file_path
  - Filesystem.file_name
  - Filesystem.dest
  security_domain: endpoint
