Uncommon Extension Shim Database Installation Via Sdbinst.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe. Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims