Application Shim Database Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the delivery of an Application Shim Database (.sdb file) over HTTP. Application Shims are used by Windows to ensure compatibility with older applications, but can also be abused by attackers for persistence and privilege escalation (e.g., by shimming malicious DLLs). Detecting the transfer of these files, especially over unencrypted HTTP, can indicate suspicious activity related to T1546.011 (Application Shimming).