Suspicious Response File Execution Via Odbcconf.EXE
Detects the execution of 'odbcconf.exe' with the '-f' flag to load a response file that does not have a '.rsp' extension. This behavior is suspicious as it deviates from the typical use of odbcconf.exe and can be leveraged by adversaries for defense evasion, specifically to proxy execution of malicious payloads.
Sigma
