ShimCache Flush Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects attempts to clear the ShimCache, a component of the Application Compatibility Database, which stores metadata about executed applications. Adversaries may clear this cache to remove forensic evidence of their activities. The rule specifically looks for command-line executions involving 'rundll32' with 'apphelp.dll' and 'ShimFlushCache' or '#250', or 'rundll32' with 'kernel32.dll' and 'BaseFlushAppcompatCache' or '#46'.