The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

Evidence of execution or file access using Shimcache

Description: Shimcache keeps a record of file execution or its existence in the Shim Database. ShimCache operates like a proxy layer between the older application and new OSs. This leaves a trail of evidence of forensic use for IR SMEs. The cache is can be located in one of the following locations HKLM\CurrentControlSet\Control\Session Manager\AppCompatibility\AppCompatCache
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache. Records in the Shim is from the time the host was last rebooted.  Data is written to the system during the reboot sequence, until then it is held in memory.

What The Data Shows:  Incident responders can use the shim cache data to determine a file's execution or if it has been executed. It provides the full path, executable name, registration timestamp on the Shim DB.

SQL:  SELECT * from appcompat_shims;

 

 

 

Tags (1)
4 Comments
jnelson
Carbon Black Employee
Status changed to: Under Review

@jaydelcic This table is actually looking at another aspect of the Application Compatibility Infrastructure as detailed in the post: http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf and referenced in the table schema.

Also a review of the code for the appcompat_shims table shows that it is looking at the registry keys in the referenced post:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom

 and not for shimcache:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache 

toliver
New Contributor

To make this query possible will CB include the Shimcache table sometime soon?

https://github.com/osquery/osquery/blob/master/osquery/tables/system/windows/shimcache.cpp

jnelson
Carbon Black Employee

@toliver the shimcache table has not been released in osquery yet. If it gets released in 4.5 then there is a possibility it will be included in CB before the end of the year.

jnelson
Carbon Black Employee

@toliver @jaydelcic A shimcache table is being added to the 4.5 version of osquery (https://github.com/osquery/osquery/releases/tag/4.5.0). As soon as it is released and we can get it into out product you will have access to it.