Custom shim database registered under AppCompatFlags

Siemphony@siemphonyhighT1546.011unverified

Detects registration of a custom application-compatibility shim database, the registry half of AN0051. Both terms are `contains` with a trailing backslash on purpose: `InstalledSDB` and `Custom` are subkeys, not value names, so the written path is `...\AppCompatFlags\InstalledSDB\{GUID}\DatabasePath` or `...\AppCompatFlags\Custom\<target.exe>\{GUID}.sdb`, and an `endswith` on the key name would have matched nothing ever. Anchoring on the parent key rather than on a hive prefix also picks up the WOW6432Node view and keeps the match independent of how the hive is rendered. The rest of the analytic — sdbinst.exe running inside a correlation window, and the shim then injecting a DLL into the target process — is a cross-source sequence Sigma cannot state, so only the persistence artefact itself is authored here; a shim registered by writing the keys directly, without sdbinst.exe, still matches. This telemetry is off by default in both feeds: Security 4657 needs the *Audit Registry* subcategory enabled **and** a SACL placed on the AppCompatFlags key, and a Sysmon-fed registry_set feed needs this subtree in the RegistryEvent include list, which the common shipped configurations do not carry. Without one of those, this rule returns zero rows because nothing is being recorded, not because nothing happened. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0017, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\AppCompatFlags\\InstalledSDB\\" or RegistryKey contains "\\AppCompatFlags\\Custom\\")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\AppCompatFlags\\InstalledSDB\\*" OR TargetObject="*\\AppCompatFlags\\Custom\\*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\appcompatflags\\\\installedsdb\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\appcompatflags\\\\custom\\\\*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\AppCompatFlags\\InstalledSDB\\|\\AppCompatFlags\\Custom\\)</field>    <description>Custom shim database registered under AppCompatFlags</description>    <mitre>      <id>T1546.011</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: edbd0c76-27f5-4746-a45c-debcea5a4041

ATT&CKT1546.011

T1546.011Application Shimming

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

The registration of a custom application-compatibility shim database — the registry half of MITRE's analytic AN0051. Windows shims let an old program run on a new OS by hooking its calls to the OS. That hooking mechanism is also a persistence and privilege-escalation primitive: register your own .sdb against a target executable and your code is injected every time that program starts. AN0051 describes the full chain — registry write, sdbinst.exe inside a correlation window, then a DLL injected into the target. Sigma has no sequence operator and no time window, so only the persistence artefact is authored here. One useful side-effect: a shim registered by writing the keys directly, without sdbinst.exe, still matches.

02 · Telemetry you need

This is the rule's one high-severity defect, so read it slowly.
The rule is written in Sysmon's registry vocabulary: TargetObject is a Sysmon EventID 12/13/14 field. The brief maps AN0051's first log source — Security EventID 4657 — onto the Sigma category registry_set, but that category is Sysmon-shaped, with a single TargetObject carrying key and value name. Security 4657 has no `TargetObject` at all. It splits the same information into ObjectName and ObjectValueName.
So the rule's own description, which tells you to enable the Audit Registry subcategory and place a SACL on the AppCompatFlags key, sends you to configure auditing for a feed this YAML structurally cannot read. Do that and you get zero rows forever — the silent failure this corpus exists to avoid, made worse because the rule looks purpose-built for 4657.
The transferable lesson: a Sigma logsource `category` implies a field vocabulary. Choosing Sysmon's here is right. What you must then do is say so, and say that the 4657 path needs a field mapping (ObjectName + ObjectValueName concatenated, or a backend rename) before anything matches.
So what you need is Sysmon with this subtree in the `RegistryEvent` include list — not in the common shipped configs. translations.json also records a Sentinel refusal for registry_set.

03 · How the logic works

Both terms are contains with a trailing backslash, and that is deliberate. InstalledSDB and Custom are subkeys, not value names. The paths actually written are ...\InstalledSDB\{GUID}\DatabasePath and ...\Custom\<target.exe>\{GUID}.sdb. An endswith on either key name would have matched nothing, ever — it would validate, render in three backends, and be a dead arm. The reviewer verified this and called it the best thing in the rule. Note it is the same trap as T1137.002: in Sysmon registry telemetry you are matching a value path, so anchor on the parent key, never on the key name. Anchoring on the parent key rather than a hive prefix also picks up the WOW6432Node view — with a consequence: sdbinst writes both views, so one install produces two alerts. Do not read that as two installs.

04 · Common false positives

Legacy line-of-business installers that ship a custom .sdb and register it at
Application Compatibility Toolkit deployments — one authoring action, the same
Image deployment and profile migration replaying the AppCompatFlags subtree.
Configuration-drift agents rewriting a value with unchanged data, which still

05 · Detection maturity

tier_1: , and no higher.** UNVERIFIED — derived from MITRE ATT&CK DET0017 and never executed against a single log line.
tier_2: starts by proving the feed: confirm you are on Sysmon, that the subtree is in the include list, and that TargetObject is populated.
tier_3: needs the sdbinst.exe and image-load legs correlated across MITRE's TimeWindow, which lives outside Sigma entirely.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names a CustomShimPathAllowlist knob for the installer case; the
Filter on the writing process rather than by dropping a term — losing either
Know the gap: a shim applied through AppCompatFlags\Layers, or via the
MITRE's UserContext knob (limit to admin/SYSTEM installs) does not help the

Declared by the author

Legacy line-of-business applications whose installers ship a custom .sdb and register it during setup, repair or upgrade. This is the supported use of the feature and it is the dominant benign volume in estates that still run pre-Windows-10 software. MITRE names a CustomShimPathAllowlist knob for exactly this; the approved database paths that go in it come from the estate's own deployment records, not from any list MITRE supplies.
Application Compatibility Toolkit deployments, where an administrator authors a shim package and pushes it to a group of hosts. One authoring action produces the same event on every targeted machine within a deployment window, so the burst looks like fleet-wide persistence.
Host rebuilds, image deployment and profile-migration tooling that replays the AppCompatFlags subtree onto a fresh machine, rewriting every registered database at once. MITRE's UserContext knob narrows alerting to admin or SYSTEM-context installs and does not help here, because the restore also runs as SYSTEM.
Registry-monitoring or configuration-drift agents that rewrite a value with unchanged data during a baseline enforcement pass, which still emits a set event.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.011, evaluated against their registry_set events.

Share this rule

/u/siemphony/edbd0c76-27f5-4746-a45c-debcea5a4041

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Custom shim database registered under AppCompatFlags

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it