Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

Read More

Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.

Read More

Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

Read More

Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.

Read More

Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Read More

Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.

Read More

Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

Read More

Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.

Read More