Windows Odbcconf.EXE Response File Execution via -f Flag
Flags Windows executions of Odbcconf.EXE using -f to load a .rsp response file.
- Product
- windows
- Category
- process_creation
- Author
- Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-22
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of Odbcconf.EXE with the -f option that reference a .rsp response file. Loading a response file can allow an attacker to supply scripted or staged actions through a trusted Windows binary, supporting stealthy execution. Telemetry relies on Windows process creation events and matches the executable identity plus command-line indicators for the -f flag and .rsp extension.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- cybereason.comhttps://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
- hexacorn.comhttps://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_response_file.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Odbcconf.EXE Response File Execution via -f Flag
id: 123b23f9-c053-498e-942d-f4de97d3bacf
related:
- id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5
type: similar
- id: 65d2be45-8600-4042-b4c0-577a1ff8a60e
type: obsolete
- id: 5f03babb-12db-4eec-8c82-7b4cb5580868
type: derived
status: test
description: This rule identifies process executions of Odbcconf.EXE with the -f option that reference a .rsp response file. Loading a response file can allow an attacker to supply scripted or staged actions through a trusted Windows binary, supporting stealthy execution. Telemetry relies on Windows process creation events and matches the executable identity plus command-line indicators for the -f flag and .rsp extension.
references:
- https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
- https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_response_file.yml
author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-22
modified: 2024-03-05
tags:
- attack.stealth
- attack.t1218.008
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \odbcconf.exe
- OriginalFileName: odbcconf.exe
selection_cli:
CommandLine|contains|windash: " -f "
selection_rsp_ext:
CommandLine|contains: .rsp
condition: all of selection_*
falsepositives:
- The rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. Investigate the contents of the ".rsp" file to determine if it is malicious and apply additional filters if necessary.
level: medium
license: DRL-1.1