Windows Odbcconf.EXE Response File Execution via -f Flag

Flags Windows executions of Odbcconf.EXE using -f to load a .rsp response file.

FreeUnreviewedSigmamediumv1

windows-odbcconf-exe-response-file-execution-via-f-flag-5f03babb

title: Windows Odbcconf.EXE Response File Execution via -f Flag
id: 123b23f9-c053-498e-942d-f4de97d3bacf
related:
  - id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5
    type: similar
  - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e
    type: obsolete
  - id: 5f03babb-12db-4eec-8c82-7b4cb5580868
    type: derived
status: test
description: This rule identifies process executions of Odbcconf.EXE with the -f option that reference a .rsp response file. Loading a response file can allow an attacker to supply scripted or staged actions through a trusted Windows binary, supporting stealthy execution. Telemetry relies on Windows process creation events and matches the executable identity plus command-line indicators for the -f flag and .rsp extension.
references:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_response_file.yml
author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-22
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1218.008
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \odbcconf.exe
    - OriginalFileName: odbcconf.exe
  selection_cli:
    CommandLine|contains|windash: " -f "
  selection_rsp_ext:
    CommandLine|contains: .rsp
  condition: all of selection_*
falsepositives:
  - The rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. Investigate the contents of the ".rsp" file to determine if it is malicious and apply additional filters if necessary.
level: medium
license: DRL-1.1

What it detects

This rule identifies process executions of Odbcconf.EXE with the -f option that reference a .rsp response file. Loading a response file can allow an attacker to supply scripted or staged actions through a trusted Windows binary, supporting stealthy execution. Telemetry relies on Windows process creation events and matches the executable identity plus command-line indicators for the -f flag and .rsp extension.

Known false positives

The rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. Investigate the contents of the ".rsp" file to determine if it is malicious and apply additional filters if necessary.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.