Windows Registry: New ODBC Driver Registration in Suspicious Path

Alerts when Windows registers a new ODBC driver under the ODBCINST.INI area with details pointing to suspicious filesystem paths.

FreeUnreviewedSigmahighv1

windows-registry-new-odbc-driver-registration-in-suspicious-path-e4d22291

title: "Windows Registry: New ODBC Driver Registration in Suspicious Path"
id: 326ea041-5896-4e22-a001-10b7e33fa5fa
status: test
description: This rule flags registry entries for newly registered ODBC drivers and setups whose driver-related strings contain paths commonly associated with staging, writable locations, or unusual system subfolders. Attackers can use ODBC driver registration as a persistence mechanism or to execute malicious logic via legitimate database connectivity components. The detection relies on registry set event telemetry that includes the TargetObject and Details fields for the ODBCINST.INI driver registration location.
references:
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_odbc_driver_registered_susp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-23
modified: 2023-08-17
tags:
  - attack.credential-access
  - attack.persistence
  - attack.t1003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\
    TargetObject|endswith:
      - \Driver
      - \Setup
    Details|contains:
      - :\PerfLogs\
      - :\ProgramData\
      - :\Temp\
      - :\Users\Public\
      - :\Windows\Registration\CRMLog
      - :\Windows\System32\com\dmp\
      - :\Windows\System32\FxsTmp\
      - :\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\
      - :\Windows\System32\spool\drivers\color\
      - :\Windows\System32\spool\PRINTERS\
      - :\Windows\System32\spool\SERVERS\
      - :\Windows\System32\Tasks_Migrated\
      - :\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\
      - :\Windows\SysWOW64\com\dmp\
      - :\Windows\SysWOW64\FxsTmp\
      - :\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\
      - :\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - :\Windows\Tracing\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4
    type: derived

What it detects

This rule flags registry entries for newly registered ODBC drivers and setups whose driver-related strings contain paths commonly associated with staging, writable locations, or unusual system subfolders. Attackers can use ODBC driver registration as a persistence mechanism or to execute malicious logic via legitimate database connectivity components. The detection relies on registry set event telemetry that includes the TargetObject and Details fields for the ODBCINST.INI driver registration location.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.