Odbcconf loading a DLL through REGSVR or a response file

Siemphony@siemphonymediumT1218.008unverified

Matches the first step of AN1335's behaviour chain: a process creation of odbcconf.exe carrying either the `REGSVR` action, which hands a DLL path to the ODBC installer to load and call, or the `/f` response-file switch, which moves that same action into a text file where the string `REGSVR` never reaches the command line. Both branches are required because either one on its own leaves half the technique invisible — `odbcconf /a {REGSVR c:\users\public\file.dll}` is the form every public write-up shows, and `odbcconf /f payload.rsp` is how that command is hidden from exactly this kind of string match. The response-file branch is written with `windash` because odbcconf accepts `/f` and `-f` alike, and the dash variants are a standard way to slip a literal match. MITRE's `AllowedCommandPatterns` and `ParentProcessName` knobs are where an estate records the installer processes and argument shapes it expects to see; neither is applied here, because both are site-specific and an empty allowlist would silently disable the rule. Four limits are worth stating. A renamed copy of odbcconf.exe defeats the `Image` gate entirely, and renaming a signed LOLBIN is cheap. Sysmon EventID 1 does carry `OriginalFileName`, which survives a rename, and this rule is already written in Sysmon field names, so that gate is available and is simply not used here: it would put the binary anchor on two different fields, and the brief's own process source for this analytic is Security 4688, which has no equivalent to fall back on. A Sysmon-only estate should add `OriginalFileName: 'odbcconf.exe'` as an alternative to the `Image` test, and should expect the extra field to cost a backend or two. The rest of the chain is also not attempted: the module load of the payload DLL (Sysmon EventID 7) needs MITRE's `ApprovedModuleHashes` baseline to say anything, and the network and DNS legs (Sysmon EventID 3 and 22) describe what the loaded payload does rather than what odbcconf did, gated by a `TimeWindow` correlation lib/sigma cannot express. Vocabulary and prerequisite: the brief maps Security 4688 onto the Sysmon-shaped `process_creation` category, and this rule is written in the Sysmon EventID 1 vocabulary (`Image`, `CommandLine`); an estate feeding 4688 instead needs `NewProcessName` mapped onto `Image` first, and 4688 requires both *Audit Process Creation* and the separate *Include command line in process creation events* policy before `CommandLine` exists at all — neither is on in a default install or in the MS and CIS baselines, and without them this rule returns zero rows, which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0486, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\odbcconf.exe" and (ProcessCommandLine contains "REGSVR" or (ProcessCommandLine contains "-f " or ProcessCommandLine contains "/f " or ProcessCommandLine contains "–f " or ProcessCommandLine contains "—f " or ProcessCommandLine contains "―f ")))

Splunk · SPL

Run this as a search.

index=* (Image="*\\odbcconf.exe" AND (CommandLine="*REGSVR*" OR (CommandLine="*-f *" OR CommandLine="*/f *" OR CommandLine="*–f *" OR CommandLine="*—f *" OR CommandLine="*―f *")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\odbcconf.exe" AND (TO_LOWER(process.command_line) LIKE "*regsvr*" OR (TO_LOWER(process.command_line) LIKE "*-f *" OR TO_LOWER(process.command_line) LIKE "*/f *" OR TO_LOWER(process.command_line) LIKE "*–f *" OR TO_LOWER(process.command_line) LIKE "*—f *" OR TO_LOWER(process.command_line) LIKE "*―f *")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\odbcconf\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(REGSVR|(-f |/f |–f |—f |―f ))</field>    <description>Odbcconf loading a DLL through REGSVR or a response file</description>    <mitre>      <id>T1218.008</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b8a43262-a4ad-4d8e-a2a4-8b8bff725426

ATT&CKT1218.008

T1218.008Odbcconf

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

AN1335 describes a chain: odbcconf.exe is invoked, it loads an attacker's DLL, that DLL then makes network and DNS connections. This rule implements the first link only — a process creation of odbcconf.exe carrying either the REGSVR action, which hands a DLL path to the ODBC installer to load and call, or the /f response-file switch, which moves that same action into a text file where the string REGSVR never touches the command line. A hit therefore means odbcconf was asked to register something, not that a malicious module ran. Confirming that needs the module-load leg, which is not covered here.

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN1335. The brief maps Security 4688 onto that Sysmon-shaped category, and this rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine). An estate feeding 4688 must map NewProcessName onto Image first, and 4688 needs both Audit Process Creation and the separate Include command line in process creation events policy before CommandLine exists at all. Neither is on in a default install or in the MS and CIS baselines, and without them the rule returns zero rows — which reads as quiet when it means blind.

03 · How the logic works

Three blocks, condition selection_binary and 1 of selection_action*. selection_binary is Image|endswith: '\odbcconf.exe'. This bounds the noise to one signed LOLBIN, and it is also the rule's cheapest evasion: a renamed copy defeats it outright. Sysmon EventID 1 does carry OriginalFileName, which survives a rename, and the rule is already in that vocabulary — the omission is a choice not to split the binary anchor across two fields, not a limitation. A Sysmon-only estate should add OriginalFileName: 'odbcconf.exe' and expect the extra field to cost a backend rendering. selection_action_regsvr is CommandLine|contains: 'REGSVR' — the form every write-up shows, odbcconf /a {REGSVR c:\users\public\file.dll}. selection_action_responsefile is CommandLine|contains|windash: '-f '. windash is what makes /f and -f both match, since dash variants are a standard way to slip a literal. Note the trailing space: it covers odbcconf /f payload.rsp but not a form without a separator, and nobody has confirmed which separator forms odbcconf's parser actually accepts. In the other direction, on a long command line any argument value containing /f matches. Only the space-separated form is covered. MITRE's AllowedCommandPatterns and ParentProcessName knobs are where a site records the installers and argument shapes it expects. Neither is applied here: both are site-specific, and an empty allowlist would silently disable the rule. ApprovedModuleHashes belongs to the module-load leg and TimeWindow to the network leg — both out of reach.

04 · Common false positives

Loudest by a wide margin: legitimate ODBC driver installation, which is what odbcconf.exe exists for. The SQL Server, Oracle, PostgreSQL, Snowflake and Simba driver packages register their libraries with exactly odbcconf /a {REGSVR <driver>.dll} or drive it from a /f response file. The command shape is identical to the abuse. That is why the rule is medium.
Behind it: SCCM, Intune or Ansible pushing a BI client across hundreds of hosts in one window; MSI repair re-registering an installed driver; and analysts reinstalling a driver by hand from an elevated prompt.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data: derived from a MITRE scaffold with no query logic, never executed against a log line.
tier_2: run read-only through one patch cycle, rank hits by parent process and DLL path, and turn that into the exclusions above.
tier_3: ** join this event to a Sysmon EventID 7 module load by the same odbcconf process, so an alert means a DLL was actually loaded rather than a command was typed.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate MITRE's ParentProcessName knob with your own deployment chain —
Allowlist the DLL paths of drivers you actually deploy, then treat any REGSVR
Verify odbcconf's other actions — INSTALLDRIVER, CONFIGDSN, CONFIGSYSDSN —

Declared by the author

ODBC driver installation, which is what odbcconf.exe is for. The setup packages for the Microsoft ODBC Driver for SQL Server, Oracle, PostgreSQL, MySQL, Snowflake and the Simba/Magnitude family register their driver libraries with exactly odbcconf /a {REGSVR <driver>.dll} or drive the same action from a /f response file. The command shape is identical to the abuse, so on any estate that deploys database drivers this is the loudest match by a wide margin and is why the rule is medium rather than high.
Software deployment waves. An SCCM, Intune, Chocolatey or Ansible package that installs or upgrades a BI, ERP, reporting or line-of-business client runs those same driver installers unattended across hundreds of hosts in one window, producing a burst of identical matches from a management service account.
MSI repair, self-healing and upgrade custom actions re-registering an already-installed ODBC driver, which fires whenever an application is repaired, patched or launched by a user whose profile is missing a registered component.
Developer and analyst workstations, where installing or reinstalling a driver by hand to fix a broken data source is routine and is done interactively from an elevated prompt.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.008, evaluated against their process_creation events.

Share this rule

/u/siemphony/b8a43262-a4ad-4d8e-a2a4-8b8bff725426

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Odbcconf loading a DLL through REGSVR or a response file

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it