Uncommon Extension Shim Database Installation Via Sdbinst.EXE
Detects the installation of a potentially suspicious new shim database using sdbinst.exe where the command line does not contain common, legitimate file extensions or flags. Adversaries may use application shimming for persistence or privilege escalation.
Sigma
