The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Endgame Process Injection July 2017) Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179) to redirect the code as necessary in order to communicate with the OS.A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:
%WINDIR%\AppPatch\sysmain.sdbhklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdbCustom databases are stored in:
%WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Customhklm\software\microsoft\windows nt\currentversion\appcompatflags\customTo keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to Bypass User Account Control (UAC) (RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress). Similar to Hooking, utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.
-
Atomic Test #2 - New shim database files created in the default shim database directory
-
Atomic Test #3 - Registry key creation and/or modification events for SDB
To test injecting DLL into a custom application you need to copy AtomicShim.dll Into C:\Tools As well as Compile the custom app. We believe observing the shim install is a good place to start.
Supported Platforms: Windows
| Name | Description | Type | Default Value |
|---|---|---|---|
| file_path | Path to the shim databaase file | String | PathToAtomicsFolder\T1138\src\AtomicShimx86.sdb |
sdbinst.exe #{file_path}
sdbinst.exe -u #{file_path}
https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
Supported Platforms: Windows
Copy-Item $PathToAtomicsFolder\T1138\bin\T1138CompatDatabase.sdb C:\Windows\apppatch\Custom\T1138CompatDatabase.sdb
Copy-Item $PathToAtomicsFolder\T1138\bin\T1138CompatDatabase.sdb C:\Windows\apppatch\Custom\Custom64\T1138CompatDatabase.sdb
Remove-Item C:\Windows\apppatch\Custom\T1138CompatDatabase.sdb
Remove-Item C:\Windows\apppatch\Custom\Custom64\T1138CompatDatabase.sdb
https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
Supported Platforms: Windows
New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1138" -Value "AtomicRedTeamT1138"
New-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1138" -Value "AtomicRedTeamT1138"
Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom" -Name "AtomicRedTeamT1138"
Remove-ItemProperty -Path HKLM:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB" -Name "AtomicRedTeamT1138"