T1546.011 — Application Shimming

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.011 Event Triggered Execution: Application Shimming

title: "T1546.011 Event Triggered Execution: Application Shimming"
id: e18e3cc0-1e56-4a88-9fa9-0b32e1dc15a1
description: 'Detection Strategy for Application Shimming via sdbinst.exe and Registry Artifacts (Windows). (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: CustomShimPathAllowlist, TimeWindow, DLLInjectionTarget, UserContext, ShimCommandLinePattern.'
references:
  - https://attack.mitre.org/techniques/T1546/011
author: Shahrukh Khan
date: 2026-02-24
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.011

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\sdbinst.exe'

  condition: selection

falsepositives:
  - Legitimate application-compatibility shim database installation by IT for legacy software support — rare enough in modern environments to warrant review regardless.

level: high

Related sub-techniques

Explore