Potential Shim Database Persistence via Sdbinst.EXE

SigmaHQ Detections@sigmaHQ

•updated Dec 6, 2023•0•0•1

Detects installation of a new shim using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims