Odbcconf Used for DLL Proxy Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects HTTP traffic where the URI contains both 'odbcconf' and 'REGSVR' (case-insensitive). This combination is indicative of an attempt to use odbcconf.exe for DLL proxy execution, a technique often employed by adversaries for defense evasion.