Defending Against Malicious Application Compatibility Shims
summary
Shows how the Application Compatibility Toolkit (ACT) builds and installs shim database sdb files that hook the import table, inject code (example: inject dll) and hot‑patch processes; demos include using CompatAdmin and sdbinst to inject a Putty keylogger, redirect Firefox profiles over SMB, and hide autorun persistence. Covers observed abuse by BlackEnergy/Roaming Tiger/Gutkit, the UAC redirect‑exe bypass, UNC‑hosted sdbs, and ships defenders’ tools (shim file scanner, volatility sdb scanner and shim cache parser).
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:32Understanding shims
- 6:19Shim engine mechanics
- 13:03Creating malicious shims
- 20:45Registry and installation
- 25:03Malicious use cases
- 28:11UAC bypass techniques
- 30:40Malware abuse examples
- 35:17Red team applications
- 37:29Tactical demos
- 42:26Subverting security tools
- 47:25Advanced evasion tactics
- 52:28Detection and defense
related talks
42mCracking the Perimeter with SharpShooter
41mSimulation Hacking, the Good, Bad and the Ugly
48m"Sneaking Past Device Guard"
25mCommSec D1 - A Deep Dive Into Malicious Documents
43mSneaking Past Device Guard
36mBeing A Better Defender By Channeling Your Worst Adversary:
56mHacking .NET(C#) Applications: The Black Arts (ASM attacks)
51mSneaking Past Device Guard