Suspicious Shim Database Patching Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.