Windows: Suspicious Odbcconf.EXE REGSVR usage with non-DLL-suffixed target

Flags odbcconf.exe launched with REGSVR while the target lacks a .dll extension on Windows process creation.

FreeUnreviewedSigmahighv1

windows-suspicious-odbcconf-exe-regsvr-usage-with-non-dll-suffixed-target-ba4cfc11

title: "Windows: Suspicious Odbcconf.EXE REGSVR usage with non-DLL-suffixed target"
id: 33332e3a-75c2-47dc-b068-f2539e65ef7b
related:
  - id: 9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70
    type: derived
  - id: ba4cfc11-d0fa-4d94-bf20-7c332c412e76
    type: derived
status: test
description: This rule identifies executions of odbcconf.exe using the REGSVR action where the command line does not include a .dll extension for the target DLL. Attackers may use this pattern to register malicious code while attempting to evade simple extension-based defenses. The detection relies on Windows process creation telemetry, specifically the executable path/name and the presence of REGSVR in the command line, plus the absence of a .dll substring.
references:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr_susp.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-22
tags:
  - attack.stealth
  - attack.t1218.008
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \odbcconf.exe
    - OriginalFileName: odbcconf.exe
  selection_cli:
    CommandLine|contains: "REGSVR "
  filter_main_dll_ext:
    CommandLine|contains: .dll
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies executions of odbcconf.exe using the REGSVR action where the command line does not include a .dll extension for the target DLL. Attackers may use this pattern to register malicious code while attempting to evade simple extension-based defenses. The detection relies on Windows process creation telemetry, specifically the executable path/name and the presence of REGSVR in the command line, plus the absence of a .dll substring.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.