ShimCache Flush

Status: stable
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects actions that clear the local ShimCache and remove forensic evidence

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: ShimCache Flush
id: b0524451-19af-4efa-a46f-562a977f792e
status: stable
description: Detects actions that clear the local ShimCache and remove forensic evidence
references:
    - https://medium.com/@blueteamops/shimcache-flush-89daff28d15e
author: Florian Roth (Nextron Systems)
date: 2021-02-01
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection1a:
        CommandLine|contains|all:
            - 'rundll32'
            - 'apphelp.dll'
    selection1b:
        CommandLine|contains:
            - 'ShimFlushCache'
            - '#250'
    selection2a:
        CommandLine|contains|all:
            - 'rundll32'
            - 'kernel32.dll'
    selection2b:
        CommandLine|contains:
            - 'BaseFlushAppcompatCache'
            - '#46'
    condition: ( selection1a and selection1b ) or ( selection2a and selection2b )
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

( selection1a and selection1b ) or ( selection2a and selection2b )

Stage 1: `selection1a`

selection1a:
    CommandLine|contains|all:
        - 'rundll32'
        - 'apphelp.dll'

Stage 2: `selection1b`

selection1b:
    CommandLine|contains:
        - 'ShimFlushCache'
        - '#250'

Stage 3: `selection2a`

selection2a:
    CommandLine|contains|all:
        - 'rundll32'
        - 'kernel32.dll'

Stage 4: `selection2b`

selection2b:
    CommandLine|contains:
        - 'BaseFlushAppcompatCache'
        - '#46'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`#250` corpus 2 (sigma 1, chronicle 1) `#46` corpus 2 (sigma 1, chronicle 1) `BaseFlushAppcompatCache` corpus 2 (sigma 1, chronicle 1) `ShimFlushCache` corpus 2 (sigma 1, chronicle 1) `apphelp.dll` corpus 2 (sigma 1, chronicle 1) `kernel32.dll` corpus 2 (sigma 1, chronicle 1) `rundll32` corpus 26 (sigma 23, chronicle 2, kusto 1)	`field:"CommandLine" kind:match`

ShimCache Flush

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1a

Stage 2: selection1b

Stage 3: selection2a

Stage 4: selection2b

Indicators

Stage 0: `condition`

Stage 1: `selection1a`

Stage 2: `selection1b`

Stage 3: `selection2a`

Stage 4: `selection2b`