[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/12/09"

[rule]
author = ["Elastic"]
description = """
The Application Shim was created to allow for backward compatibility of software as the operating system codebase
changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary
code execution in legitimate Windows processes.
"""
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License"
name = "Potential Application Shimming via Sdbinst"
risk_score = 21
rule_id = "fd4a992d-6130-4802-9ff8-829b89ae801f"
severity = "low"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Persistence"]
type = "query"

query = '''
event.category:process and event.type:(start or process_started) and process.name:sdbinst.exe
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[rule.threat.technique.subtechnique]]
id = "T1546.011"
name = "Application Shimming"
reference = "https://attack.mitre.org/techniques/T1546/011/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[rule.threat.technique.subtechnique]]
id = "T1546.011"
name = "Application Shimming"
reference = "https://attack.mitre.org/techniques/T1546/011/"


[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

