Potential Persistence Via Shim Database In Uncommon Location

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

Detects the installation of a new shim database where the file is located in a non-default location. This can be an indicator of persistence or privilege escalation attempts using application shimming.