Possible New ODBC Driver Registered (via registry_set)

title: Possible New ODBC Driver Registered (via registry_set)
id: c991b91e-9b30-5a31-8743-ebbeda187850
status: stable
description: This rule detects the registration of a new ODBC driver.
references:
    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
author: Huntrule Team
date: 2026-05-16
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\ODBC\ODBCINST.INI\'
        TargetObject|endswith: '\Driver'
    filter_main_sqlserver:
        TargetObject|contains: '\SQL Server\'
        Details: '%WINDIR%\System32\SQLSRV32.dll'
    filter_optional_office_access:
        TargetObject|contains: '\Microsoft Access '
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    filter_optional_office_excel:
        TargetObject|contains: '\Microsoft Excel Driver'
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    filter_hr:
        TargetObject|contains:
            - \ODBC Driver 17 for SQL Server\
            - \ODBC Driver 18 for SQL Server\
        Details|endswith:
            - \msodbcsql17.dll
            - \msodbcsql18.dll
    condition: (selection and not 1 of filter_main_* and not 1 of filter_optional_*) and not filter_hr
falsepositives:
    - Unknown
level: low