T1546.011

Event Triggered Execution: Application Shimming

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. [1]

攻撃者は、アプリケーションシムによって引き起こされる悪意のあるコンテンツを実行することで、永続性を確立したり、権限を昇格させたりすることができます。Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) は、オペレーティングシステムのコードベースが時間とともに変化しても、ソフトウェアの後方互換性を保つことができるようにするために作成されました。例えば、アプリケーションシム機能により、開発者はWindows XP向けに作成されたアプリケーションに(コードを書き換えることなく)修正を適用し、Windows 10で動作するようにすることができます。[1]

Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.

A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:

  • %WINDIR%\AppPatch\sysmain.sdb and
  • hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb

Custom databases are stored in:

  • %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
  • hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom

To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to Bypass User Account Control (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).

Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. [2] Shims can also be abused to establish persistence by continuously being invoked by affected programs.

メモ Application Shimmingって何ぞや。

ID: T1546.011
Sub-technique of:  T1546
Platforms: Windows
Permissions Required: Administrator
Version: 1.0
Created: 24 January 2020
Last Modified: 10 November 2020

Procedure Examples

ID Name Description
G0046 FIN7

FIN7 has used application shim databases for persistence.[3]

S0517 Pillowmint

Pillowmint has used a malicious shim database to maintain persistence.[4]

S0461 SDBbot

SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.[5]

S0444 ShimRat

ShimRat has installed shim databases in the AppPatch folder.[6]

Mitigations

ID Mitigation Description
M1051 Update Software

Microsoft released an optional patch update - KB3045645 - that will remove the "auto-elevate" flag within the sdbinst.exe. This will prevent use of application shimming to bypass UAC.

M1052 User Account Control

Changing UAC settings to "Always Notify" will give the user more visibility when UAC elevation is requested, however, this option will not be popular among users due to the constant UAC interruptions.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for sdbinst.exe for potential indications of application shim abuse.

DS0022 File File Modification

Monitor for changes made to files that may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

DS0011 Module Module Load

Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process.

DS0009 Process Process Creation

Monitor newly executed processs for sdbinst.exe for potential indications of application shim abuse. There are several public tools available that will detect shims that are currently available [7]:* Shim-Process-Scanner - checks memory of every running process for any shim flags* Shim-Detector-Lite - detects installation of custom shim databases* Shim-Guard - monitors registry for any shim installations* ShimScanner - forensic tool to find active shims in memory* ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot)

DS0024 Windows Registry Windows Registry Key Modification

Monitor for changes to windows registry keys and/or values that may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

References