New ODBC Driver Registered
This rule detects the registration of new ODBC (Open Database Connectivity) drivers by monitoring modifications to specific registry keys. It specifically looks for changes within the `\SOFTWARE\ODBC\ODBCINST.INI\` path where the `TargetObject` ends with `\Driver`. The rule includes filters to exclude common legitimate ODBC driver registrations for SQL Server, Microsoft Access, and Microsoft Excel to reduce false positives.
Sigma
