Windows: Detect Odbcconf.exe INSTALLDRIVER DLL Installation via Process Command Line
Alerts when odbcconf.exe is run with INSTALLDRIVER and a .dll, indicating potential malicious ODBC driver DLL installation.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-22
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags executions of odbcconf.exe where the command line includes the INSTALLDRIVER action and references a .dll. Installing an ODBC driver through odbcconf can be abused to introduce and subsequently load attacker-controlled DLLs, making this behavior a high-value persistence or execution step to investigate. It relies on Windows process creation telemetry, matching the process image/original filename and specific command-line substrings.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- web.archive.orghttps://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
- hexacorn.comhttps://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect Odbcconf.exe INSTALLDRIVER DLL Installation via Process Command Line"
id: f279f4f5-3e42-4e43-a136-08f440ebb689
related:
- id: cb0fe7c5-f3a3-484d-aa25-d350a7912729
type: similar
- id: 3f5491e2-8db8-496b-9e95-1029fce852d4
type: derived
status: test
description: This rule flags executions of odbcconf.exe where the command line includes the INSTALLDRIVER action and references a .dll. Installing an ODBC driver through odbcconf can be abused to introduce and subsequently load attacker-controlled DLLs, making this behavior a high-value persistence or execution step to investigate. It relies on Windows process creation telemetry, matching the process image/original filename and specific command-line substrings.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-22
tags:
- attack.stealth
- attack.t1218.008
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \odbcconf.exe
- OriginalFileName: odbcconf.exe
selection_cli:
CommandLine|contains|all:
- "INSTALLDRIVER "
- .dll
condition: all of selection_*
falsepositives:
- Legitimate driver DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its contents to determine if the action is authorized.
level: medium
license: DRL-1.1