New DLL Registered Via Odbcconf.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects the execution of 'odbcconf.exe' with the 'REGSVR' flag to register a new DLL. This technique is often abused by attackers to install and run malicious DLLs, similar to how 'regsvr32.exe' is used. The detection specifically looks for the 'odbcconf.exe' image and command-line arguments containing both 'REGSVR ' and '.dll'.