Windows: Detect Odbcconf.exe INSTALLDRIVER DLL Installation via Process Command Line

Alerts when odbcconf.exe is run with INSTALLDRIVER and a .dll, indicating potential malicious ODBC driver DLL installation.

FreeUnreviewedSigmamediumv1

windows-detect-odbcconf-exe-installdriver-dll-installation-via-process-command-l-3f5491e2

title: "Windows: Detect Odbcconf.exe INSTALLDRIVER DLL Installation via Process Command Line"
id: f279f4f5-3e42-4e43-a136-08f440ebb689
related:
  - id: cb0fe7c5-f3a3-484d-aa25-d350a7912729
    type: similar
  - id: 3f5491e2-8db8-496b-9e95-1029fce852d4
    type: derived
status: test
description: This rule flags executions of odbcconf.exe where the command line includes the INSTALLDRIVER action and references a .dll. Installing an ODBC driver through odbcconf can be abused to introduce and subsequently load attacker-controlled DLLs, making this behavior a high-value persistence or execution step to investigate. It relies on Windows process creation telemetry, matching the process image/original filename and specific command-line substrings.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-22
tags:
  - attack.stealth
  - attack.t1218.008
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \odbcconf.exe
    - OriginalFileName: odbcconf.exe
  selection_cli:
    CommandLine|contains|all:
      - "INSTALLDRIVER "
      - .dll
  condition: all of selection_*
falsepositives:
  - Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized.
level: medium
license: DRL-1.1

What it detects

This rule flags executions of odbcconf.exe where the command line includes the INSTALLDRIVER action and references a .dll. Installing an ODBC driver through odbcconf can be abused to introduce and subsequently load attacker-controlled DLLs, making this behavior a high-value persistence or execution step to investigate. It relies on Windows process creation telemetry, matching the process image/original filename and specific command-line substrings.

Known false positives

Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.