Suspicious Shim Database Patching Activity

Rule Info

Name

Suspicious Shim Database Patching Activity

Author

Nasreddine Bencherchali (Nextron Systems)

Description

Detects installation of new shim databases that try to patch sections of known processes for potential process injection or persistence.

Reference

Date

2023-08-01 00:00:00

Modified

2023-12-06 00:00:00

bf344fea-d947-4ef4-9192-34d008315d3a

Rule History

Author

Title

Date

Commit

github-actions[bot]

Merge PR #5027 from @nasbench - Promote older rules status from `experimental` to `test`

2024-10-01

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

Nasreddine Bencherchali

Merge PR #4577 from @nasbench - Multiple Fixes & Updates

2023-12-21

frack113

Refractor registry_set rules

2023-08-17

Nasreddine Bencherchali

Update rules/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml

2023-08-04

Nasreddine Bencherchali

feat: update shim rules

2023-08-01