Driver/DLL Installation Via Odbcconf.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects the execution of "odbcconf.exe" with the "INSTALLDRIVER" argument, which is used to install new ODBC drivers. Attackers often abuse this legitimate Windows utility to install and execute malicious DLLs, bypassing application control solutions and achieving defense evasion.