name: Shim Database File Creation
id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33
version: 3
date: '2020-12-08'
author: David Dorsey, Splunk
status: production
type: TTP
description: This search looks for shim database files being written to default directories.
  The sdbinst.exe application is used to install shim database files (.sdb). According
  to Microsoft, a shim is a small library that transparently intercepts an API, changes
  the parameters passed, handles the operation itself, or redirects the operation
  elsewhere.
data_source:
- Sysmon Event ID 11
search:
  selection1:
    TargetFilename: '*Windows\\AppPatch\\Custom*'
  condition: selection1
how_to_implement: You must be ingesting data that records the filesystem activity
  from your hosts to populate the Endpoint file-system data model node. If you are
  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
  you want to collect data.
known_false_positives: Because legitimate shim files are created and used all the
  time, this event, in itself, is not suspicious. However, if there are other correlating
  events, it may warrant further investigation.
references: []
tags:
  analytic_story:
  - Windows Persistence Techniques
  asset_type: Endpoint
  confidence: 80
  impact: 70
  message: A process that possibly write shim database in $file_path$ in host $dest$
  mitre_attack_id:
  - T1546.011
  - T1546
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: file_path
    type: File
    role:
    - Other
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 56
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog