Response File Execution Via Odbcconf.EXE

 1title: Response File Execution Via Odbcconf.EXE
 2id: 5f03babb-12db-4eec-8c82-7b4cb5580868
 3related:
 4    - id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5
 5      type: similar
 6    - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e
 7      type: obsoletes
 8status: experimental
 9description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.
10references:
11    - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
12    - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
13    - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
14    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
15author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)
16date: 2023/05/22
17modified: 2024/03/05
18tags:
19    - attack.defense_evasion
20    - attack.t1218.008
21logsource:
22    category: process_creation
23    product: windows
24detection:
25    selection_img:
26        - Image|endswith: '\odbcconf.exe'
27        - OriginalFileName: 'odbcconf.exe'
28    selection_cli:
29        CommandLine|contains|windash: ' -f '
30    selection_rsp_ext:
31        CommandLine|contains: '.rsp'
32    condition: all of selection_*
33falsepositives:
34    - The rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. Investigate the contents of the ".rsp" file to determine if it is malicious and apply additional filters if necessary.
35level: medium

References

• ODBCCONF.EXE - Open Database Connectivity (ODBC)

  

  ODBCCONF.EXE

  
  Read More

• Odbcconf | LOLBAS

  Execute: DLL This LOLBAS executes Dynamic-Link Libraries (DLLs).

  
  Read More

• THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

  

  Cybereason GSOC observed distribution of the Bumblebee Loader and post-exploitation activities including privilege escalation, reconnaissance and credential theft. Bumblebee operators use the Cobalt Strike framework throughout the attack and abuse credentials for privilege escalation to access Active Directory, as well as abusing a domain administrator account to move laterally, create local user accounts and exfiltrate data...

  
  Read More

• ODBCConf – Lolbin Trifecta

  

  I posted about ODBCConf before and then posted again on Twitter. The Twitter bit was about REGSVR: odbcconf.exe /a {REGSVR c:\test\test.dll} – loads a DLL At that time I looked at other ACTIONS acc...

  
  Read More

Related rules

• Certificate Exported Via Certutil.EXE
• Curl Download And Execute Combination
• DLL Loaded via CertOC.EXE
• Diskshadow Script Mode - Execution From Potential Suspicious Location
• Diskshadow Script Mode - Uncommon Script Extension Execution