attack.t1218.008

Driver/DLL Installation Via Odbcconf.EXE

Apr 28, 2026 · attack.stealth attack.t1218.008 ·

Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

New DLL Registered Via Odbcconf.EXE

Apr 28, 2026 · attack.stealth attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.

Odbcconf.EXE Suspicious DLL Location

Apr 28, 2026 · attack.stealth attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

Potentially Suspicious DLL Registered Via Odbcconf.EXE

Apr 28, 2026 · attack.stealth attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.

Response File Execution Via Odbcconf.EXE

Apr 28, 2026 · attack.stealth attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Suspicious Driver/DLL Installation Via Odbcconf.EXE

Apr 28, 2026 · attack.stealth attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.

Suspicious Response File Execution Via Odbcconf.EXE

Apr 28, 2026 · attack.stealth attack.t1218.008 ·

Share on:

Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

Uncommon Child Process Spawned By Odbcconf.EXE

Apr 28, 2026 · attack.stealth attack.t1218.008 ·

Share on:

Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.