Esc

Application Shimming - T1546.011

(ATT&CK® Technique)

Definition

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1546011["Application Shimming"] --> |creates| Shim["Shim"]; class T1546011 OffensiveTechniqueNode;
        class Shim ArtifactNode; click Shim href "/dao/artifact/d3f:Shim";
        click T1546011 href "/offensive-technique/attack/T1546.011/"; click Shim href "/dao/artifact/d3f:Shim"; T1546011["Application Shimming"] --> |modifies| ShimDatabase["Shim Database"]; class T1546011 OffensiveTechniqueNode;
        class ShimDatabase ArtifactNode; click ShimDatabase href "/dao/artifact/d3f:ShimDatabase";
        click T1546011 href "/offensive-technique/attack/T1546.011/"; click ShimDatabase href "/dao/artifact/d3f:ShimDatabase";                             RestoreConfiguration["Restore Configuration"] -->
          | restores | ShimDatabase["Shim Database"];

          RestoreConfiguration["Restore Configuration"] -.->
            | may-restore | T1546011["Application Shimming"] ;
          class RestoreConfiguration DefensiveTechniqueNode;
          class ShimDatabase ArtifactNode;
          click RestoreConfiguration href "/technique/d3f:RestoreConfiguration";                                                     RestoreSoftware["Restore Software"] -->
          | restores | Shim["Shim"];

          RestoreSoftware["Restore Software"] -.->
            | may-restore | T1546011["Application Shimming"] ;
          class RestoreSoftware DefensiveTechniqueNode;
          class Shim ArtifactNode;
          click RestoreSoftware href "/technique/d3f:RestoreSoftware"; SoftwareUpdate["Software Update"] -->
          | updates | Shim["Shim"];

          SoftwareUpdate["Software Update"] -.->
            | may-harden | T1546011["Application Shimming"] ;
          class SoftwareUpdate DefensiveTechniqueNode;
          class Shim ArtifactNode;
          click SoftwareUpdate href "/technique/d3f:SoftwareUpdate";

json