Uncommon Child Process Spawned By Odbcconf.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects the creation of any child process by 'odbcconf.exe'. Typically, 'odbcconf.exe' should not spawn child processes. Adversaries often abuse 'odbcconf.exe' to proxy execution of malicious payloads, such as DLLs, to bypass application control solutions. This behavior is indicative of potential defense evasion tactics.