Which technique can be used by attackers to escalate privileges, install backdoors, and disable Windows Defender by manipulating application behavior?

Which technique can be used by attackers to escalate privileges, install backdoors, and disable Windows Defender by manipulating application behavior?

• A. Shims
• B. Pivoting
• C. Application Shimming
• D. Path Interception

Answer: (C)

Application Shimming uses the Windows Application Compatibility framework to alter how a specific program runs at runtime. It works by applying a shim database that can intercept or replace certain Windows API calls made by the target application. Because of this, an attacker can steer the program to execute code they added, bypass privilege checks, or load a malicious DLL within a trusted process, effectively escalating privileges, installing a backdoor, or disabling security features like Windows Defender without changing the program’s binary itself. This makes it the best fit for the scenario because it focuses on modifying the behavior of a legitimate application to achieve stealthy, high-impact outcomes. The other options don’t capture this specific capability: path interception is about redirecting where files are loaded from, pivoting is lateral movement across systems, and a general reference to shims lacks the runtime behavior manipulation tied to a single application.

Application Shimming uses the Windows Application Compatibility framework to alter how a specific program runs at runtime. It works by applying a shim database that can intercept or replace certain Windows API calls made by the target application. Because of this, an attacker can steer the program to execute code they added, bypass privilege checks, or load a malicious DLL within a trusted process, effectively escalating privileges, installing a backdoor, or disabling security features like Windows Defender without changing the program’s binary itself.

This makes it the best fit for the scenario because it focuses on modifying the behavior of a legitimate application to achieve stealthy, high-impact outcomes. The other options don’t capture this specific capability: path interception is about redirecting where files are loaded from, pivoting is lateral movement across systems, and a general reference to shims lacks the runtime behavior manipulation tied to a single application.