Suspicious ImageLoad via ODBC Driver Configuration Program

[rule]
description = """
Identifies abuse of the ODBC Driver Configuration Program to load an arbitrary DLL. This behavior is used as a defense
evasion technique to blend-in malicious activity with legitimate Windows software.
"""
id = "1faebe83-38d7-4390-b6bd-9c6b851e47c4"
license = "Elastic License v2"
name = "Suspicious ImageLoad via ODBC Driver Configuration Program"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/"]
version = "1.0.27"

query = '''
process where event.action == "start" and
  (process.pe.original_file_name == "odbcconf.exe" or process.name : "odbcconf.exe") and
   process.args : ("-a", "-f", "/a", "/f") and
   not (process.args : "?:\\Windows\\SysWOW64\\ODBCCONF.RSP" and process.parent.name : "InstallManager.exe") and
   not (process.args : "{CONFIGSYSDSN*" and process.Ext.token.integrity_level_name : ("high", "system")) and 
   not process.args: ("SQL Server", "C:\\WINDOWS\\system32\\odbcconf.tmp")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.008"
name = "Odbcconf"
reference = "https://attack.mitre.org/techniques/T1218/008/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"