Custom shim database registered under AppCompatFlags

1title: Custom shim database registered under AppCompatFlags2id: edbd0c76-27f5-4746-a45c-debcea5a40413status: experimental4description: |5  Detects registration of a custom application-compatibility shim database, the6  registry half of AN0051. Both terms are `contains` with a trailing backslash7  on purpose: `InstalledSDB` and `Custom` are subkeys, not value names, so the8  written path is `...\AppCompatFlags\InstalledSDB\{GUID}\DatabasePath` or9  `...\AppCompatFlags\Custom\<target.exe>\{GUID}.sdb`, and an `endswith` on the10  key name would have matched nothing ever. Anchoring on the parent key rather11  than on a hive prefix also picks up the WOW6432Node view and keeps the match12  independent of how the hive is rendered. The rest of the analytic — sdbinst.exe13  running inside a correlation window, and the shim then injecting a DLL into the14  target process — is a cross-source sequence Sigma cannot state, so only the15  persistence artefact itself is authored here; a shim registered by writing the16  keys directly, without sdbinst.exe, still matches. This telemetry is off by17  default in both feeds: Security 4657 needs the *Audit Registry* subcategory18  enabled **and** a SACL placed on the AppCompatFlags key, and a Sysmon-fed19  registry_set feed needs this subtree in the RegistryEvent include list, which20  the common shipped configurations do not carry. Without one of those, this rule21  returns zero rows because nothing is being recorded, not because nothing happened.22  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0017, not hand-written and not tested by its author. Any lab result is on this rule's own page.23references:24  - https://attack.mitre.org/techniques/T1546/01125  - https://attack.mitre.org/detectionstrategies/DET001726author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)27date: 2026-08-1628tags:29  - attack.privilege-escalation30  - attack.persistence31  - attack.t1546.01132logsource:33  category: registry_set34  product: windows35detection:36  selection:37    TargetObject|contains:38      - '\AppCompatFlags\InstalledSDB\'39      - '\AppCompatFlags\Custom\'40  condition: selection41falsepositives:42  - "Legacy line-of-business applications whose installers ship a custom .sdb and register it during setup, repair or upgrade. This is the supported use of the feature and it is the dominant benign volume in estates that still run pre-Windows-10 software. MITRE names a CustomShimPathAllowlist knob for exactly this; the approved database paths that go in it come from the estate's own deployment records, not from any list MITRE supplies."43  - "Application Compatibility Toolkit deployments, where an administrator authors a shim package and pushes it to a group of hosts. One authoring action produces the same event on every targeted machine within a deployment window, so the burst looks like fleet-wide persistence."44  - "Host rebuilds, image deployment and profile-migration tooling that replays the AppCompatFlags subtree onto a fresh machine, rewriting every registered database at once. MITRE's UserContext knob narrows alerting to admin or SYSTEM-context installs and does not help here, because the restore also runs as SYSTEM."45  - "Registry-monitoring or configuration-drift agents that rewrite a value with unchanged data during a baseline enforcement pass, which still emits a set event."46level: high