Windows: Uncommon Child Process Spawned by Odbcconf.EXE

Alert on unusual child processes spawned from odbcconf.exe, which may indicate indirect execution abuse.

FreeUnreviewedSigmamediumv1

windows-uncommon-child-process-spawned-by-odbcconf-exe-8e3c7994

title: "Windows: Uncommon Child Process Spawned by Odbcconf.EXE"
id: 245ac08b-a1a5-4f4d-bc66-3e02dccd140a
status: test
description: This rule flags process creation events where the parent process is odbcconf.exe, and the child process is treated as uncommon. Attackers may abuse odbcconf.exe to execute code indirectly, so unexpected child processes can indicate DLL-based or execution chain activity. It relies on Windows process creation telemetry, matching events by the parent executable path ending with \odbcconf.exe.
references:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://medium.com/@cyberjyot/t1218-008-dll-execution-using-odbcconf-exe-803fa9e08dac
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml
author: Harjot Singh @cyb3rjy0t, Huntrule Team
date: 2023-05-22
tags:
  - attack.stealth
  - attack.t1218.008
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \odbcconf.exe
  condition: selection
falsepositives:
  - In rare occurrences where "odbcconf" crashes. It might spawn a "werfault" process
  - Other child processes will depend on the DLL being registered by actions like "regsvr". In case where the DLLs have external calls (which should be rare). Other child processes might spawn and additional filters need to be applied.
level: medium
license: DRL-1.1
related:
  - id: 8e3c7994-131e-4ba5-b6ea-804d49113a26
    type: derived

What it detects

This rule flags process creation events where the parent process is odbcconf.exe, and the child process is treated as uncommon. Attackers may abuse odbcconf.exe to execute code indirectly, so unexpected child processes can indicate DLL-based or execution chain activity. It relies on Windows process creation telemetry, matching events by the parent executable path ending with \odbcconf.exe.

Known false positives

In rare occurrences where "odbcconf" crashes. It might spawn a "werfault" process
Other child processes will depend on the DLL being registered by actions like "regsvr". In case where the DLLs have external calls (which should be rare). Other child processes might spawn and additional filters need to be applied.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.