Application Shimming
Subtechnique · ATTACK:enterprise:T1546.011
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1546.011",
"title": "Application Shimming",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1546/011",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--42fe883a-21ea-4cfb-b94a-78b6476dcc83",
"external_id": "T1546.011",
"domain": "enterprise",
"created": "2020-01-24T14:56:24.231Z",
"modified": "2025-10-24T17:48:42.703Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"privilege-escalation",
"persistence"
],
"source_references": [
{
"source_name": "Elastic Process Injection July 2017",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
},
{
"source_name": "FireEye Application Shimming",
"url": "http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf"
},
{
"source_name": "Black Hat 2015 App Shim",
"url": "https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0517 → uses → ATTACK:enterprise:T1546.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09896887-98ee-4e8a-9cc2-4203b3b561c8
Trustwave Pillowmint June 2020ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1546.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e29cbcc-3e45-4e62-a66f-4479b310ccdb
Proofpoint TA505 October 2019ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1546.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--506acc8a-e691-4f4e-b69f-bfab84cf2c73
FireEye FIN7 Shim DatabasesATTACK:enterprise:M1052 → mitigates → ATTACK:enterprise:T1546.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5329d477-4378-4635-8da8-ed427d7863fc
ATTACK:enterprise:T1546.011 → subtechnique-of → ATTACK:enterprise:T1546
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57a31238-b362-4c07-b8ae-45a619ece297
ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1546.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ec20e7b-8996-4f16-b830-1f8a0e99b778
FOX-IT May 2016 MofangATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1546.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9fd0f73-917d-4d53-9843-a1314720942f