Potential Shim Database Persistence via Sdbinst.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects the installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.