Application Shimming abuse (MITRE ATT&CK T1546.011) is a Windows persistence and privilege escalation technique built on a compatibility feature. The Application Compatibility Infrastructure, or shim framework, lets old software keep working as the operating system changes. For example, a fix can let a Windows XP program run on Windows 10 without rewriting its code.
How attackers use it
Shims sit as a buffer between a program and the operating system. When a program starts, the shim cache is checked to see whether it needs a shim database (.sdb). If so, the database uses hooking to redirect code as needed.
MITRE lists where shims are recorded. The default installer, sdbinst.exe, records installed shims in %WINDIR%\AppPatch\sysmain.sdb and in the registry key hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb. Custom databases live in %WINDIR%\AppPatch\custom and %WINDIR%\AppPatch\AppPatch64\Custom, and in hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom.
Shims run in user mode and need administrator privileges to install, so they cannot change the kernel. Even so, MITRE notes certain shims can bypass User Account Control (the UAC and RedirectEXE shims), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structured Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress). An adversary can use this to elevate privileges, install backdoors or disable defenses such as Windows Defender. Since the affected program triggers the shim each time it runs, it also persists.
How to detect it
MITRE's strategy correlates:
- Changes to AppCompat registry keys.
- Execution of sdbinst.exe to install a custom shim database.
- DLL injection into the target application that follows.
Any custom shim database on a standard workstation build is worth explaining, since most fleets have none.
How to reduce the risk
- Raise UAC visibility. Setting UAC to Always Notify gives users more visibility when elevation is requested. MITRE admits this will not be popular because of constant prompts.
- Patch. Microsoft released an optional update, KB3045645, that removes the auto-elevate flag within sdbinst.exe, which prevents shimming from being used to bypass UAC.
Check your own environment
Read-only commands from a Windows command prompt:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" /s
dir "%WINDIR%\AppPatch\Custom"
On a typical build these should be empty or missing. Anything present needs an owner and a business reason.
Quick check
Which tool installs custom shim databases?
sdbinst.exe. Watching for its execution is part of MITRE's detection strategy.
Do shims need administrator rights to install?
Yes. Shims run in user mode and need administrator privileges to install, which is why registration events from non-admin contexts are suspicious.
