System Binary Proxy Execution: Odbcconf T1218.008

Tactic: Stealth

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names. The Odbcconf.exe binary may be digitally signed by Microsoft.

Events covered

3 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 17 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (8 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine9contains 9, in 2.dll, .rsp, -f , installdriver , regsvr
process_name9eq 9bginfo.exe, arp.exe, atbroker.exe, odbcconf.exe, cdb.exe
Image7ends_with 7, eq 1\odbcconf.exe, c:\windows\system32\odbcconf.exe
OriginalFileName7eq 7odbcconf.exe
event.type6eq 6start
ParentImage3eq 2, ends_with 1?:\program files (x86)\teamcity\jre\bin\java.exe, ?:\program files\teamcity\jre\bin\java.exe, ?:\teamcity\buildagent\jre\bin\java.exe, \odbcconf.exe, c:\windows\system32\runonce.exe
parent_process_name3eq 3AcroRd32.exe, Acrobat.exe, FoxitPhantomPDF.exe, eqnedt32.exe, excel.exe
dns.question.name1is_not_null 1

Top indicator values (117 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
process_nameeq
odbcconf.exe
910
process_nameeq
bginfo.exe
66
process_nameeq
cdb.exe
67
process_nameeq
cmstp.exe
610
process_nameeq
csi.exe
66
process_nameeq
dnx.exe
66
process_nameeq
fsi.exe
66
process_nameeq
ieexec.exe
68
process_nameeq
iexpress.exe
68
process_nameeq
microsoft.workflow.compiler.exe
68
process_nameeq
rcsi.exe
66
process_nameeq
xwizard.exe
69
process_nameeq
installutil.exe
518
process_nameeq
mshta.exe
531
process_nameeq
msxsl.exe
59
process_nameeq
regsvr32.exe
525
process_nameeq
wscript.exe
529
process_nameeq
arp.exe
48
process_nameeq
atbroker.exe
45
process_nameeq
bitsadmin.exe
414
process_nameeq
certutil.exe
422
process_nameeq
cmd.exe
477
process_nameeq
cscript.exe
425
process_nameeq
dsget.exe
47
process_nameeq
dsquery.exe
412
process_nameeq
forfiles.exe
47
Imageends_with
\odbcconf.exe
711
OriginalFileNameeq
odbcconf.exe
79
event.typeeq
start
6606
CommandLinecontains
.dll
416

Exclusions (55 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
CommandLinecontains
.dll
2
CommandLinecontains
.exe /e /f "c:\windows\system32\odbcconf.tmp"
1
CommandLinecontains
.rsp
1
Imageeq
c:\windows\system32\odbcconf.exe
1
ParentImageeq
c:\windows\system32\runonce.exe
1
ParentImagewildcard
c:\program files (x86)\amazon\amazon assistant\amazonassistantservice.exe
1
ParentImagewildcard
c:\program files (x86)\bentley\*.exe
1
ParentImagewildcard
c:\program files\bentley\*.exe
1
ParentImagewildcard
c:\users\*\appdata\local\temp\teamviewer\teamviewer.exe
1
dns.question.nameeq
client.teamviewer.com
1
dns.question.nameeq
images-na.ssl-images-amazon.com
1
dns.question.nameeq
searcherbar.tilda.ws
1
dns.question.nameeq
www.teamviewer.com
1
dns.question.namestarts_with
host.name
1
dns.question.namewildcard
*.local
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 8 rules

Elastic 6 rules

Splunk 3 rules