sdbinst.exe
Sources: 300M+ executions observed in the wild.
Summary
Windows Application Compatibility Database Installer - installs application compatibility shim databases (.sdb files) that modify application behavior at runtime.
sdbinst.exe is the 821st most commonly executed Windows program in EchoTrail's dataset, observed 3,659 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Get this in your tools
The same record for sdbinst.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/sdbinst.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3293.25%
- C:\Windows\SysWOW646.75%
Top Hashes (SHA256)
- 29e98ce8d214358ad4fbf6daf6374a83524b938b4a624f686862e698f765269c31.52%
- 6cc48f57e15d171e2afcb59543d5e2e61c7338a89a07924d278e2a9d57f579a020.59%
- dd04783db8334dc82399956e04d089607e91b3942c92bbb1b3b482ae20f8402911.2%
- f668b054476fee2380fd6091439725f22cc5f774579dc1924acddc75a453383e7.04%
- 282086b837400fd2db00df5dc238782e482c6ff1f46adfee697214688838acad6.79%
- 4e2217e6b6ac20fc3e14e70c377f3f57f3b161a7ca7c29683939408e47ce48006.05%
- 4437b40482baeedbd92ffaabc7d7b0b244ac5e68a2a93e4881f5772ce7c77bb14.85%
- f92f5a22c6dff993b7ae5428c7c235938c8099d08389b581ec25cac0fc0dc51b4.11%
- 234aa1bf13ba45c48b11b70a6fb23dba11cde584fb89bfceb5aff086258429942.63%
- 078893c42058905373489a8bd2f3d72935d6b0098949335a5ef16876d48a461f2.3%
Process Ancestry
Top Grandparents
- services.exe69.12%
- svchost.exe30.03%
- msiexec.exe0.57%
- explorer.exe0.28%
Top Parents
- svchost.exe89.99%
- msiexec.exe6.67%
- rundll32.exe3.12%
- TrustedInstaller.exe0.16%
- cmd.exe0.03%
- SystemSettings.exe0.03%
Top Children
- conhost.exe100%
Security Analysis
What does sdbinst.exe normally do?
Used to install compatibility fixes for legacy applications. Part of the Windows Application Compatibility Framework.
When is sdbinst.exe suspicious?
Installing custom .sdb files from temp or user directories. Running on systems without known application compatibility needs.
How do attackers abuse sdbinst.exe?
Attackers create custom shim databases (.sdb files) that inject code into target applications or redirect API calls. Shims persist across reboots and can be difficult to detect. Used for both persistence and defense evasion.
Detection guidance
Monitor for sdbinst.exe execution. Track .sdb file creation and installation. Alert on shim database installations from non-standard paths.
False positive notes
Enterprise application compatibility teams may deploy custom shims. SCCM can deploy shim databases for legacy app support.
MITRE ATT&CK techniques
Ask Rocky about sdbinst.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for sdbinst.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.