Windows: Odbcconf.exe used to register a DLL via REGSVR

Flags odbcconf.exe executions using REGSVR to register a DLL, a regsvr32-equivalent technique often abused by attackers.

FreeUnreviewedSigmamediumv1

windows-odbcconf-exe-used-to-register-a-dll-via-regsvr-9f0a8bf3

title: "Windows: Odbcconf.exe used to register a DLL via REGSVR"
id: d778859c-1547-49dd-a38f-4a7f64d44f6e
related:
  - id: ba4cfc11-d0fa-4d94-bf20-7c332c412e76
    type: similar
  - id: 9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70
    type: derived
status: test
description: This rule identifies Windows process executions where odbcconf.exe is invoked with command-line content indicating a REGSVR-style DLL registration (includes 'REGSVR ' and '.dll'). Attackers can use this equivalent technique to regsvr32 to register a malicious DLL so it can be executed or loaded later. The detection relies on process creation telemetry, matching the image/original filename for odbcconf.exe and the presence of the DLL registration parameters in the command line.
references:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://redcanary.com/blog/raspberry-robin/
  - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
  - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml
author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-22
tags:
  - attack.stealth
  - attack.t1218.008
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \odbcconf.exe
    - OriginalFileName: odbcconf.exe
  selection_cli:
    CommandLine|contains|all:
      - "REGSVR "
      - .dll
  condition: all of selection_*
falsepositives:
  - Legitimate DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its content to determine if the action is authorized.
level: medium
license: DRL-1.1

What it detects

This rule identifies Windows process executions where odbcconf.exe is invoked with command-line content indicating a REGSVR-style DLL registration (includes 'REGSVR ' and '.dll'). Attackers can use this equivalent technique to regsvr32 to register a malicious DLL so it can be executed or loaded later. The detection relies on process creation telemetry, matching the image/original filename for odbcconf.exe and the presence of the DLL registration parameters in the command line.

Known false positives

Legitimate DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its content to determine if the action is authorized.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.