detection.wiki

Detection rules › Sigma

Response File Execution Via Odbcconf.EXE

Status
test
Severity
medium
Log source
category process_creation, product windows
Author
Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Known false positives

  • The rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. Investigate the contents of the ".rsp" file to determine if it is malicious and apply additional filters if necessary.

MITRE ATT&CK coverage

TacticTechniques
Stealth

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation

Rule body

title: Response File Execution Via Odbcconf.EXE
id: 5f03babb-12db-4eec-8c82-7b4cb5580868
related:
    - id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5
      type: similar
    - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e
      type: obsolete
status: test
description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.
references:
    - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
    - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
    - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-22
modified: 2024-03-05
tags:
    - attack.stealth
    - attack.t1218.008
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\odbcconf.exe'
        - OriginalFileName: 'odbcconf.exe'
    selection_cli:
        CommandLine|contains|windash: ' -f '
    selection_rsp_ext:
        CommandLine|contains: '.rsp'
    condition: all of selection_*
falsepositives:
    - The rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. Investigate the contents of the ".rsp" file to determine if it is malicious and apply additional filters if necessary.
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\odbcconf.exe'
    - OriginalFileName: 'odbcconf.exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|windash: ' -f '

Stage 3: selection_rsp_ext

selection_rsp_ext:
    CommandLine|contains: '.rsp'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • -f transforms: windash corpus 8 (sigma 6, chronicle 2)
  • .rsp corpus 2 (sigma 1, splunk 1)
field:"CommandLine" kind:match
Imageends_with
  • \odbcconf.exe corpus 11 (sigma 11)
field:"Image" kind:ends_with value:"\odbcconf.exe"
OriginalFileNameeq
  • odbcconf.exe corpus 12 (sigma 9, elastic 3)
field:"OriginalFileName" kind:eq value:"odbcconf.exe"