Suspicious Shim Database Patching Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•13•0•36

Detects the installation of new shim databases that attempt to patch sections of known processes for potential process injection or persistence. This rule specifically looks for modifications to the AppCompatFlags\Custom registry key where shims are typically registered, targeting common system processes.