Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
40
6
5
2
1
Contributors
21
18
6
3
2
Categories
47
14
2
1
1
Platforms
53
1
Products / Services
18
14
6
4
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the odbcconf LOLBin delivery step assessed for the MuddyWater-linked PatchAgent chain: 'odbcconf /f cloud.rsp' launched from a PatchAgent working directory, typically via a ClickFix lure (explorer -> conhost --headless -> cmd -> odbcconf) fetching the response file over WebDAV. odbcconf executing a .rsp response file is rare in legitimate use and is high-fidelity when paired with WebDAV or a user-writable working directory.
The following analytic identifies the execution of Odbcconf.exe within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the process name is Odbcconf.exe. This activity is significant because Odbcconf.exe can be used by attackers to execute arbitrary commands or load malicious DLLs, potentially leading to code execution or persistence. If confirmed malicious, this behavior could allow an attacker to maintain access to the system, execute further malicious activities, or escalate privileges, posing a significant threat to the environment.
The following analytic detects the execution of odbcconf.exe with the regsvr action to load a DLL. This is identified by monitoring command-line arguments in process creation logs from Endpoint Detection and Response (EDR) agents. This activity is significant as it may indicate an attempt to execute arbitrary code via DLL loading, a common technique used in various attack vectors. If confirmed malicious, this could allow an attacker to execute code with the privileges of the odbcconf.exe process, potentially leading to system compromise or further lateral movement.
The following analytic detects the execution of odbcconf.exe with a response file, which may contain commands to load a DLL (REGSVR) or other instructions. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it may indicate an attempt to execute arbitrary code or load malicious DLLs, potentially leading to unauthorized actions. If confirmed malicious, this could allow an attacker to gain code execution, escalate privileges, or establish persistence within the environment.
Detects the misuse of the legitimate odbcconf.exe utility via the /A switch combined with the REGSVR action. Attackers leverage this behavior to execute malicious DLLs, often utilizing response files or executing from non-standard directories to bypass application control policies.
Detects the execution of odbcconf.exe with the REGSVR action. This technique leverages the legitimate Windows utility odbcconf.exe to load and execute arbitrary DLLs, bypassing security controls that might not monitor or restrict this binary.
Detects the use of odbcconf.exe with the REGSVR flag to load DLLs from suspicious directory locations (such as Temp, Downloads, or AppData), a technique used by adversaries to proxy execution and bypass application control.
Detects the odbcconf LOLBin delivery step assessed for the MuddyWater-linked PatchAgent chain: 'odbcconf /f cloud.rsp' launched from a PatchAgent working directory, typically via a ClickFix lure (explorer -> conhost --headless -> cmd -> odbcconf) fetching the response file over WebDAV. odbcconf executing a .rsp response file is rare in legitimate use and is high-fidelity when paired with WebDAV or a user-writable working directory.
Detects Odbcconf used for DLL registration as proxy execution technique
Detects signed Windows binaries abused as execution proxies for defense evasion
This rule detects HTTP traffic where the URI contains both 'odbcconf' and 'REGSVR' (case-insensitive). This combination is indicative of an attempt to use odbcconf.exe for DLL proxy execution, a technique often employed by adversaries for defense evasion.
Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.
Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.
Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.
Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.
Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.
Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.
Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.
Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.
Detects the loading of 'Amsi.dll' by specific Living Off the Land Binaries (LOLBINs) such as ExtExport.exe, odbcconf.exe, and rundll32.exe. This activity can indicate an attempt to bypass Antimalware Scan Interface (AMSI) protections, often associated with 'PowerShell without PowerShell' attacks where malicious scripts are executed without directly invoking powershell.exe.
This rule detects the subsequent execution of commands associated with Raspberry Robin malware. Specifically, it looks for processes where 'fodhelper.exe' is the parent process, and the child process is either 'rundll32.exe' or 'regsvr32.exe'. Additionally, the command line of the child process must contain specific strings like 'odbcconf.exe', 'regsvr', 'shellexec_rundll', and other keywords such as 'installdriver', 'setfiledsndir', or 'vkipdse', combined with specific command-line switches like '/a', '/f', or '/s'. This combination of parent-child processes and command-line arguments is indicative of Raspberry Robin's post-exploitation activities, often involving the abuse of legitimate Windows utilities for defense evasion and execution.
Page 1 of 3