Sigma rule: Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Rule

Title

Uncommon Extension Shim Database Installation Via Sdbinst.EXE

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-08-01

Modified

2024-01-10

File

rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims

Log source

product

windows

category

process_creation

Detection

selection:
    - Image|endswith: '\sdbinst.exe'
    - OriginalFileName: 'sdbinst.exe'
filter_main_legit_ext:
    CommandLine|contains: '.sdb'
filter_main_legit_extensions:
    # ParentImage|endswith: ':\Windows\System32\svchost.exe'
    - CommandLine|endswith:
          - ' -c'
          - ' -f'
          - ' -mm'
          - ' -t'
    - CommandLine|contains: ' -m -bg'
filter_main_null:
    CommandLine: null
filter_main_empty:
    CommandLine: ''
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.persistence
• attack.privilege-escalation
• attack.t1546.011

MITRE ATT&CK ids this rule names

• T1546.011

Related rules

• 517490a7-115a-48c6-8862-1a481504d5a8 (derived)

References

• https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
• https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml