New Custom Shim Database Created

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•21

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. This rule detects the creation of new custom shim database files in the default Windows shim database directories, which can indicate an attempt to abuse the Application Compatibility Infrastructure for malicious purposes.