Cross-source coverage
T1218.008 / ATT&CK
System Binary Proxy Execution: Odbcconf
18 rules across 4 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names. The Odbcconf.exe binary may be digitally signed by Microsoft.
Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}).
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmon
How MITRE says to detect it DET0486
Detecting Odbcconf Proxy Execution of Malicious DLLs
Windows Analytic 1335
Identifies abuse of odbcconf.exe to execute malicious DLLs using the REGSVR command flag. Behavior chain: (1) Process creation of odbcconf.exe with /REGSVR or /A {REGSVR...} arguments → (2) DLL load by odbcconf.exe of non-standard or unsigned modules → (3) Optional follow-on process creation or network activity from loaded DLL.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=3, 22
SigmaHQ/sigma
8 rules| Detection | Severity | Format |
|---|---|---|
| Odbcconf.EXE Suspicious DLL Location | High | Sigma |
| Potentially Suspicious DLL Registered Via Odbcconf.EXE | High | Sigma |
| Suspicious Driver/DLL Installation Via Odbcconf.EXE | High | Sigma |
| Suspicious Response File Execution Via Odbcconf.EXE | High | Sigma |
| Driver/DLL Installation Via Odbcconf.EXE | Medium | Sigma |
| New DLL Registered Via Odbcconf.EXE | Medium | Sigma |
| Response File Execution Via Odbcconf.EXE | Medium | Sigma |
| Uncommon Child Process Spawned By Odbcconf.EXE | Medium | Sigma |
elastic/detection-rules
6 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious JetBrains TeamCity Child Process | Medium | Elastic TOML |
| Suspicious MS Office Child Process | Medium | Elastic TOML |
| Unusual Network Activity from a Windows System Binary | Medium | Elastic TOML |
| Suspicious MS Outlook Child Process | Low | Elastic TOML |
| Suspicious PDF Reader Child Process | Low | Elastic TOML |
| Unusual Process Network Connection | Low | Elastic TOML |
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| Windows Odbcconf Hunting | Undefined | SPL |
| Windows Odbcconf Load DLL | Undefined | SPL |
| Windows Odbcconf Load Response File | Undefined | SPL |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious ImageLoad via ODBC Driver Configuration Program | Undefined | Elastic TOML |