Windows Registry: New ODBC Driver Registration via ODBCINST.INI

title: "Windows Registry: New ODBC Driver Registration via ODBCINST.INI"
id: 4420afa0-725c-477a-a52a-913f65adf4bd
status: test
description: This rule identifies new entries written to the ODBC driver registry path by matching updates under SOFTWARE\ODBC\ODBCINST.INI\ and driver keys ending with \Driver. Attackers may register or replace ODBC drivers to establish persistence and to route execution through trusted components. It relies on Windows registry set events capturing the TargetObject and (when present) DLL path details used to narrow matches for common, benign driver registrations.
references:
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_odbc_driver_registered.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-23
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\
    TargetObject|endswith: \Driver
  filter_main_sqlserver:
    TargetObject|contains: \SQL Server\
    Details: "%WINDIR%\\System32\\SQLSRV32.dll"
  filter_optional_office_access:
    TargetObject|contains: "\\Microsoft Access "
    Details|startswith: C:\Progra
    Details|endswith: \ACEODBC.DLL
  filter_optional_office_excel:
    TargetObject|contains: \Microsoft Excel Driver
    Details|startswith: C:\Progra
    Details|endswith: \ACEODBC.DLL
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: 3390fbef-c98d-4bdd-a863-d65ed7c610dd
    type: derived