Potentially Suspicious DLL Registered Via Odbcconf.EXE Without .dll Extension

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of "odbcconf.exe" with the "REGSVR" action where the DLL specified in the command line does not contain a ".dll" extension. This technique is often used by adversaries to evade defenses by registering malicious DLLs without the typical file extension.