Suspicious Driver/DLL Installation Via Odbcconf.EXE Without DLL Extension
This rule detects the execution of 'odbcconf.exe' with the 'INSTALLDRIVER' action where the driver specified in the command line does not have a '.dll' extension. This behavior is often indicative of defense evasion, as adversaries may abuse odbcconf.exe to execute arbitrary code or bypass application control by installing non-DLL files as drivers.
Sigma
