Potential Persistence Via Shim Database In Uncommon Location (6b6976a3-b0e6-4723-ac24-ae38a737af41)

Detects the installation of a new shim database where the file is located in a non-default location

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Application Shimming - T1546.011 (42fe883a-21ea-4cfb-b94a-78b6476dcc83)	Attack Pattern	Potential Persistence Via Shim Database In Uncommon Location (6b6976a3-b0e6-4723-ac24-ae38a737af41)	Sigma-Rules	1
Application Shimming - T1546.011 (42fe883a-21ea-4cfb-b94a-78b6476dcc83)	Attack Pattern	Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db)	Attack Pattern	2