MuddyWater PatchAgent - Odbcconf Response File Execution

Georg Lauenstein@gsec

•updated Jul 21, 2026•1•0•15

Detects the odbcconf LOLBin delivery step assessed for the MuddyWater-linked PatchAgent chain: 'odbcconf /f cloud.rsp' launched from a PatchAgent working directory, typically via a ClickFix lure (explorer -> conhost --headless -> cmd -> odbcconf) fetching the response file over WebDAV. odbcconf executing a .rsp response file is rare in legitimate use and is high-fidelity when paired with WebDAV or a user-writable working directory.