TA0003 · PERSISTENCE
Application Shimming
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
Detect it with
There are several public tools available that will detect shims that are currently available : Shim-Process-Scanner - checks memory of every running process for any shim flags Shim-Detector-Lite - detects installation of custom shim databases Shim-Guard - monitors registry for…
Why it matters on shift
Application Shimming is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context