Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the installation of new shim databases that attempt to patch sections of known processes for potential process injection or persistence. This rule specifically looks for modifications to the AppCompatFlags\Custom registry key where shims are typically registered, targeting common system processes.
