T1546.011sub-technique of T1546 Event Triggered Execution

Application Shimming

Windowsnothing on this site yetT1546.011 on attack.mitre.org

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspicious execution on an endpoint

An EDR alert, an unexplained process, or a user reporting something odd.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detection Strategy for Application Shimming via sdbinst.exe and Registry Artifacts (Windows)

Correlated modification of AppCompat registry keys and execution of sdbinst.exe to install custom shim databases. Followed by DLL injection via shim behavior into target application processes.

what reduces it

M1052 User Account Control. Changing UAC settings to "Always Notify" will give the user more visibility when UAC elevation is requested, however, this option will not be popular among users due to the constant UAC interruptions.
M1051 Update Software. Microsoft released an optional patch update - KB3045645 - that will remove the "auto-elevate" flag within the sdbinst.exe. This will prevent use of application shimming to bypass UAC.

the rest of T1546

T1546.001 Change Default File Association · not covered yet
T1546.002 Screensaver · not covered yet
T1546.003 Windows Management Instrumentation Event Subscription · 5 on this site
T1546.004 Unix Shell Configuration Modification · not covered yet
T1546.005 Trap · not covered yet
T1546.006 LC_LOAD_DYLIB Addition · not covered yet
T1546.007 Netsh Helper DLL · not covered yet
T1546.008 Accessibility Features · not covered yet
T1546.009 AppCert DLLs · not covered yet
T1546.010 AppInit DLLs · not covered yet
T1546.012 Image File Execution Options Injection · not covered yet
T1546.013 PowerShell Profile · not covered yet
T1546.014 Emond · not covered yet
T1546.015 Component Object Model Hijacking · not covered yet
T1546.016 Installer Packages · not covered yet
T1546.017 Udev Rules · not covered yet
T1546.018 Python Startup Hooks · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.