detection.wiki

Detection rules › Sigma

New ODBC Driver Registered

Status
test
Severity
low
Log source
category registry_set, product windows
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the registration of a new ODBC driver.

Known false positives

  • Likely

MITRE ATT&CK coverage

TacticTechniques
PersistenceNo specific technique

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 13: RegistryEvent (Value Set)

Rule body

title: New ODBC Driver Registered
id: 3390fbef-c98d-4bdd-a863-d65ed7c610dd
status: test
description: Detects the registration of a new ODBC driver.
references:
    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-23
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\ODBC\ODBCINST.INI\'
        TargetObject|endswith: '\Driver'
    filter_main_sqlserver:
        TargetObject|contains: '\SQL Server\'
        Details: '%WINDIR%\System32\SQLSRV32.dll'
    filter_optional_office_access:
        TargetObject|contains: '\Microsoft Access '
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    filter_optional_office_excel:
        TargetObject|contains: '\Microsoft Excel Driver'
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Likely
level: low

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: selection

selection:
    TargetObject|contains: '\SOFTWARE\ODBC\ODBCINST.INI\'
    TargetObject|endswith: '\Driver'

Stage 2: not filter_main_sqlserver

filter_main_sqlserver:
    TargetObject|contains: '\SQL Server\'
    Details: '%WINDIR%\System32\SQLSRV32.dll'

Stage 3: not filter_optional_*

filter_optional_office_access:
    TargetObject|contains: '\Microsoft Access '
    Details|startswith: 'C:\Progra'
    Details|endswith: '\ACEODBC.DLL'
filter_optional_office_excel:
    TargetObject|contains: '\Microsoft Excel Driver'
    Details|startswith: 'C:\Progra'
    Details|endswith: '\ACEODBC.DLL'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
Detailseq%WINDIR%\System32\SQLSRV32.dllexcludes:Details field:"Details" value:"%WINDIR%\System32\SQLSRV32.dll"
TargetObjectmatch\SQL Server\excludes:TargetObject field:"TargetObject" value:"\SQL Server\"
Detailsends_with\ACEODBC.DLLexcludes:Details field:"Details" value:"\ACEODBC.DLL"
Detailsstarts_withC:\Prograexcludes:Details field:"Details" value:"C:\Progra"
TargetObjectmatch\Microsoft Access excludes:TargetObject field:"TargetObject" value:"\Microsoft Access "
TargetObjectmatch\Microsoft Excel Driverexcludes:TargetObject field:"TargetObject" value:"\Microsoft Excel Driver"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetObjectends_with
  • \Driver corpus 2 (sigma 2)
field:"TargetObject" kind:ends_with value:"\Driver"
TargetObjectmatch
  • \SOFTWARE\ODBC\ODBCINST.INI\ corpus 2 (sigma 2)
field:"TargetObject" kind:match value:"\SOFTWARE\ODBC\ODBCINST.INI\"