Windows Registry: New ODBC Driver Registration via ODBCINST.INI
Flags Windows registry changes that add ODBC driver entries under ODBCINST.INI, with exclusions for specific known benign cases.
FreeReviewedSigma · Low · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-23
- Updated
- 2026-07-30
What it detects
This rule identifies new entries written to the ODBC driver registry path by matching updates under SOFTWARE\ODBC\ODBCINST.INI\ and driver keys ending with \Driver. Attackers may register or replace ODBC drivers to establish persistence and to route execution through trusted components. It relies on Windows registry set events capturing the TargetObject and (when present) DLL path details used to narrow matches for common, benign driver registrations.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-new-odbc-driver-registration-via-odbcinst-ini-3390fbef
title: "Windows Registry: New ODBC Driver Registration via ODBCINST.INI"
id: 4420afa0-725c-477a-a52a-913f65adf4bd
status: test
description: This rule identifies new entries written to the ODBC driver registry path by matching updates under SOFTWARE\ODBC\ODBCINST.INI\ and driver keys ending with \Driver. Attackers may register or replace ODBC drivers to establish persistence and to route execution through trusted components. It relies on Windows registry set events capturing the TargetObject and (when present) DLL path details used to narrow matches for common, benign driver registrations.
references:
- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_odbc_driver_registered.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-23
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\
TargetObject|endswith: \Driver
filter_main_sqlserver:
TargetObject|contains: \SQL Server\
Details: "%WINDIR%\\System32\\SQLSRV32.dll"
filter_optional_office_access:
TargetObject|contains: "\\Microsoft Access "
Details|startswith: C:\Progra
Details|endswith: \ACEODBC.DLL
filter_optional_office_excel:
TargetObject|contains: \Microsoft Excel Driver
Details|startswith: C:\Progra
Details|endswith: \ACEODBC.DLL
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Likely
level: low
license: DRL-1.1
related:
- id: 3390fbef-c98d-4bdd-a863-d65ed7c610dd
type: derived