Windows: Odbcconf.exe used to register a DLL via REGSVR
Flags odbcconf.exe executions using REGSVR to register a DLL, a regsvr32-equivalent technique often abused by attackers.
- Product
- windows
- Category
- process_creation
- Author
- Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-22
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process executions where odbcconf.exe is invoked with command-line content indicating a REGSVR-style DLL registration (includes 'REGSVR ' and '.dll'). Attackers can use this equivalent technique to regsvr32 to register a malicious DLL so it can be executed or loaded later. The detection relies on process creation telemetry, matching the image/original filename for odbcconf.exe and the presence of the DLL registration parameters in the command line.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- redcanary.comhttps://redcanary.com/blog/raspberry-robin/
- web.archive.orghttps://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
- hexacorn.comhttps://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
- trendmicro.comhttps://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Odbcconf.exe used to register a DLL via REGSVR"
id: d778859c-1547-49dd-a38f-4a7f64d44f6e
related:
- id: ba4cfc11-d0fa-4d94-bf20-7c332c412e76
type: similar
- id: 9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70
type: derived
status: test
description: This rule identifies Windows process executions where odbcconf.exe is invoked with command-line content indicating a REGSVR-style DLL registration (includes 'REGSVR ' and '.dll'). Attackers can use this equivalent technique to regsvr32 to register a malicious DLL so it can be executed or loaded later. The detection relies on process creation telemetry, matching the image/original filename for odbcconf.exe and the presence of the DLL registration parameters in the command line.
references:
- https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
- https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- https://redcanary.com/blog/raspberry-robin/
- https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
- https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml
author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-22
tags:
- attack.stealth
- attack.t1218.008
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \odbcconf.exe
- OriginalFileName: odbcconf.exe
selection_cli:
CommandLine|contains|all:
- "REGSVR "
- .dll
condition: all of selection_*
falsepositives:
- Legitimate DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its content to determine if the action is authorized.
level: medium
license: DRL-1.1