Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
44 detections
Filters
Last updated
All Time
Detection languages
27
10
6
1
Contributors
14
13
6
4
4
Categories
17
11
5
4
4
Platforms
40
2
1
1
Products / Services
11
9
6
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Detects installation of a new shim using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims
Page 3 of 3