Windows: Uncommon Child Process Spawned by Odbcconf.EXE
Alert on unusual child processes spawned from odbcconf.exe, which may indicate indirect execution abuse.
- Product
- windows
- Category
- process_creation
- Author
- Harjot Singh @cyb3rjy0t (SigmaHQ), DRL 1.1
- Published
- 2023-05-22
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the parent process is odbcconf.exe, and the child process is treated as uncommon. Attackers may abuse odbcconf.exe to execute code indirectly, so unexpected child processes can indicate DLL-based or execution chain activity. It relies on Windows process creation telemetry, matching events by the parent executable path ending with \odbcconf.exe.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- medium.comhttps://medium.com/@cyberjyot/t1218-008-dll-execution-using-odbcconf-exe-803fa9e08dac
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Uncommon Child Process Spawned by Odbcconf.EXE"
id: 245ac08b-a1a5-4f4d-bc66-3e02dccd140a
status: test
description: This rule flags process creation events where the parent process is odbcconf.exe, and the child process is treated as uncommon. Attackers may abuse odbcconf.exe to execute code indirectly, so unexpected child processes can indicate DLL-based or execution chain activity. It relies on Windows process creation telemetry, matching events by the parent executable path ending with \odbcconf.exe.
references:
- https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
- https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- https://medium.com/@cyberjyot/t1218-008-dll-execution-using-odbcconf-exe-803fa9e08dac
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml
author: Harjot Singh @cyb3rjy0t, Huntrule Team
date: 2023-05-22
tags:
- attack.stealth
- attack.t1218.008
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \odbcconf.exe
condition: selection
falsepositives:
- In rare occurrences where "odbcconf" crashes. It might spawn a "werfault" process
- Other child processes will depend on the DLL being registered by actions like "regsvr". In case where the DLLs have external calls (which should be rare). Other child processes might spawn and additional filters need to be applied.
level: medium
license: DRL-1.1
related:
- id: 8e3c7994-131e-4ba5-b6ea-804d49113a26
type: derived