The following steps describe the manner in which an attacker may shim an application and install it on a victim system:
- An attacker creates an application compatibility database (shim database) for the target application (such as notepad.exe, or any legitimate third-party application frequently used by the victim). An attacker can choose a single shim, such as InjectDll, or multiple shims.
- The attacker saves the shim database (.sdb file) created for the target application.
- The .sdb file is delivered and dropped on the victim system (mostly via malware), and it is installed, typically using the sdbinst utility.
- The attacker invokes the target application or waits for the user to execute the target application.
- An attacker may also delete the malware that installed the shim database. In that case, you are only left with the .sdb file.
An attacker can install a shim database just by dropping the .sdb file in some location on the filesystem and modifying the minimal set of registry entries. This technique avoids using the sdbinst utility. The shim_persist object (https://github.com/hasherezade/persistence_demos/tree/master/shim_persist) is a POC, written by the security researcher Hasherezade (@hasherezade), that drops a DLL in the programdata directory and installs a shim without using the sdbinst utility to inject the dropped DLL into the explorer.exe process.
Malware authors have abused shims for different purposes, such as achieving persistence, code injection, disabling security features, executing code with elevated privileges, and bypassing a User Account Control (UAC) prompt. The following table outlines some of the interesting shims and their descriptions:
| Shim Name | Description |
| RedirectEXE | Redirects execution |
| InjectDll | Injects DLL into an application |
| DisableNXShowUI | Disables Data Execution Prevention (DEP) |
| CorrectFilePaths | Redirects filesystem paths |
| VirtualRegistry | Registry redirection |
| RelaunchElevated | Launches application with elevated privileges |
| TerminateExe | Terminates an executable upon launch |
| DisableWindowsDefender | Disables Windows Defender service for application |
| RunAsAdmin | Marks an application to run with admin privileges |
For more information on how the shims are used in the attacks, refer to the talks presented at various conferences by the security researchers, all of which can be found at https://sdb.tools/talks.html.