Potentially Suspicious ODBC Driver Registered in Non-Standard Location
Detects the registration of a new ODBC driver where the driver's DLL is located in a potentially suspicious or non-standard system directory. Adversaries may use this technique to establish persistence or facilitate credential access by registering malicious ODBC drivers.
Sigma
