New DLL Registered Via Odbcconf.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.

Known false positives

Legitimate DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its content to determine if the action is authorized.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.008` System Binary Proxy Execution: Odbcconf

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: New DLL Registered Via Odbcconf.EXE
id: 9f0a8bf3-a65b-440a-8c1e-5cb1547c8e70
related:
    - id: ba4cfc11-d0fa-4d94-bf20-7c332c412e76
      type: similar
status: test
description: Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.
references:
    - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
    - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
    - https://redcanary.com/blog/raspberry-robin/
    - https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
    - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-22
tags:
    - attack.stealth
    - attack.t1218.008
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\odbcconf.exe'
        - OriginalFileName: 'odbcconf.exe'
    selection_cli:
        # Note: The "/A" flag is not required to call a specific action
        CommandLine|contains|all:
            - 'REGSVR '
            - '.dll'
    condition: all of selection_*
falsepositives:
    - Legitimate DLLs being registered via "odbcconf" will generate false positives. Investigate the path of the DLL and its content to determine if the action is authorized.
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\odbcconf.exe'
    - OriginalFileName: 'odbcconf.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - 'REGSVR '
        - '.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`.dll` corpus 16 (sigma 16) `REGSVR` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\odbcconf.exe` corpus 11 (sigma 11)	`field:"Image" kind:ends_with value:"\odbcconf.exe"`
`OriginalFileName`	eq	`odbcconf.exe` corpus 12 (sigma 9, elastic 3)	`field:"OriginalFileName" kind:eq value:"odbcconf.exe"`