On a Windows system, a process has introduced a new shim database into the default apppatch directory. Investigate file creation logs to reveal the database filename that appeared under C:\Windows\apppatch\Custom.

DeviceFileEvents
| where ActionType == 'FileCreated'
| where FolderPath has @'C:\Windows\apppatch\Custom'
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

DeviceFileEvents
| where FolderPath startswith @"C:\Windows\apppatch\Custom"
| where ActionType == "FileCreated" or ActionType == "Created"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId
| order by TimeGenerated desc

DeviceFileEvents
| where FolderPath has_cs ("\\Windows\\apppatch\\Custom") and ActionType == 'FileCreated'
| project TimeGenerated, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessCreationTime, DeviceName

DeviceFileEvents
| where ActionType == "FileCreated" and FolderPath contains "C:\\Windows\\apppatch\\Custom"
| project TimeGenerated, FileName, FolderPath, DeviceName, DeviceId

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath startswith @"C:\Windows\AppPatch\Custom"
| where FileName endswith ".sdb"
| extend FullPath = strcat(FolderPath, "\\", FileName)
| project TimeGenerated, DeviceName, FileName, FullPath,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName,
          InitiatingProcessId, InitiatingProcessSHA256
| order by TimeGenerated desc

let targetFolder = "c:\\windows\\apppatch\\custom";
let extensions = dynamic([".sdb", ".dat", ".mdb", ".txt"]);

// helper to check if filename ends with any of the extensions
let hasExt = (fname:string) {
    tolower(fname)
    | extend _fname = tostring(fnamE)
};

// Query DeviceFileEvents
DeviceFileEvents
| where isnotempty(FolderPath)
| extend FolderPathLower = tolower(tostring(FolderPath))
| where FolderPathLower contains targetFolder
| where isnotempty(FileName)
| extend FileNameLower = tolower(tostring(FileName))
| where FileNameLower endswith ".sdb" or FileNameLower endswith ".dat" or FileNameLower endswith ".mdb" or FileNameLower endswith ".txt"
| where ActionType in ("Created","FileCreated","Create","Write","WriteFile","CreatedFile","Added","Modify") or tolower(ActionType) contains "create" or tolower(ActionType) contains "write"
| extend FullPath = strcat(FolderPath, "\\", FileName)
| project TimeGenerated, DeviceName, DeviceId, AccountName=InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, FileName, FullPath, FileSize, ActionType

| union (
    DeviceEvents
    | where isnotempty(FolderPath)
    | extend FolderPathLower = tolower(tostring(FolderPath))
    | where FolderPathLower contains targetFolder
    | where isnotempty(FileName)
    | extend FileNameLower = tolower(tostring(FileName))
    | where FileNameLower endswith ".sdb" or FileNameLower endswith ".dat" or FileNameLower endswith ".mdb" or FileNameLower endswith ".txt"
    | where ActionType in ("Created","FileCreated","Create","Write","WriteFile","CreatedFile","Added","Modify") or tolower(ActionType) contains "create" or tolower(ActionType) contains "write"
    | extend FullPath = strcat(FolderPath, "\\", FileName)
    | project TimeGenerated, DeviceName, DeviceId, AccountName=InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, FileName, FullPath, FileSize, ActionType
)
| summarize LatestTime = max(TimeGenerated) by DeviceId, DeviceName, FileName, FullPath, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCommandLine, ActionType
| order by LatestTime desc
| limit 100

// Search for files created under C:\Windows\apppatch\Custom
(
    DeviceFileEvents
    | where ActionType in ("FileCreated", "Created", "CreatedFile", "Create", "Added")
    | where FolderPath has_cs "C:\\Windows\\apppatch\\Custom" or tolower(FolderPath) startswith "c:\\windows\\apppatch\\custom"
    | extend FullPath = strcat(FolderPath, "\\", FileName)
    | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName, FileName, FolderPath, FullPath, FileSize, SHA256
)
| union (
    DeviceEvents
    | where ActionType in ("FileCreated", "Created", "CreatedFile", "Create", "Added")
    | where FolderPath has_cs "C:\\Windows\\apppatch\\Custom" or tolower(FolderPath) startswith "c:\\windows\\apppatch\\custom"
    | extend FullPath = strcat(FolderPath, "\\", FileName)
    | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName, FileName, FolderPath, FullPath, FileSize, SHA256
)
| order by TimeGenerated desc
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Devices = make_set(DeviceName), InitiatingProcesses = make_set(InitiatingProcessFileName), SampleCmd = any(InitiatingProcessCommandLine) by FileName, FolderPath, FullPath, SHA256
| project FileName, FullPath, FolderPath, SHA256, FirstSeen, LastSeen, Devices, InitiatingProcesses, SampleCmd
| sort by FirstSeen desc
| take 100

DeviceFileEvents
| where FolderPath startswith 'C:\\Windows\\apppatch\\Custom'
| where ActionType == 'FileCreated'
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by Timestamp desc

DeviceFileEvents
| where FolderPath startswith 'C:\\Windows\\apppatch\\Custom'
| where ActionType == 'FileCreated' or ActionType contains 'Create'
| where FileName endswith '.sdb'
| project FileName, FolderPath, Timestamp
| sort by Timestamp desc
| limit 10

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath has "C:\\Windows\\apppatch\\Custom"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, SHA256
| order by TimeGenerated desc

DeviceFileEvents
| where ActionType == "FileCreated"
| where tolower(FolderPath) contains "c:\\windows\\apppatch\\custom"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceFileEvents
| where ActionType in ("FileCreated", "FileCreate", "Created", "Create")
| where tolower(FolderPath) startswith "c:\\windows\\apppatch\\custom"
| where tolower(FileName) endswith ".sdb"
// Build the full on-disk path
| extend ShimDatabasePath = strcat(FolderPath, "\\", FileName)
| project TimeGenerated,
          DeviceName,
          ShimDatabasePath,
          FileSize,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          InitiatingProcessAccountDomain,
          InitiatingProcessAccountName,
          InitiatingProcessSHA256
| summarize FirstSeen = min(TimeGenerated),
            LastSeen  = max(TimeGenerated),
            EventCount = count()
            by DeviceName, ShimDatabasePath, FileSize,
               InitiatingProcessFileName,
               InitiatingProcessCommandLine,
               InitiatingProcessAccountDomain,
               InitiatingProcessAccountName,
               InitiatingProcessSHA256
| order by LastSeen desc

union DeviceFileEvents, DeviceEvents
| where FolderPath contains "C:\\Windows\\apppatch\\Custom"
| where tolower(ActionType) == "filecreated"
| project TimeGenerated, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

DeviceFileEvents
| where FolderPath has "C:\\Windows\\apppatch\\Custom"
| where ActionType == "FileCreated"
| project TimeGenerated, FileName, FolderPath

DeviceFileEvents
| where ActionType == "FileCreated"
      and FolderPath has "\\Windows\\apppatch\\Custom"
      and FileName endswith ".sdb"
| project TimeGenerated, DeviceName, FolderPath, FileName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName
| sort by TimeGenerated desc

DeviceFileEvents
| where ActionType == "FileCreated"
// Look for the Custom folder under C:\Windows\AppPatch
| where tolower(FolderPath) contains "\\windows\\apppatch\\custom"
// Shim databases have .sdb extension
| where FileName endswith ".sdb"
| project TimeGenerated, DeviceName, FullFilePath = strcat(FolderPath, "\\", FileName), InitiatingProcessFileName, InitiatingProcessCommandLine