Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
40
6
5
2
1
Contributors
21
18
6
3
2
Categories
47
14
2
1
1
Platforms
53
1
Products / Services
18
14
6
4
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the execution of 'odbcconf.exe' with the '-f' flag to load a response file that does not have a '.rsp' extension. This behavior is suspicious as it deviates from the typical use of odbcconf.exe and can be leveraged by adversaries for defense evasion, specifically to proxy execution of malicious payloads.
Detects the execution of 'odbcconf.exe' with the '-f' flag, indicating an attempt to load a response file. This technique can be abused by adversaries to execute malicious actions, often as a method of defense evasion or to bypass application controls.
Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.
Detects defence evasion attempt via odbcconf.exe execution to load DLL
Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.
Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.
Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.
Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.
Detects defence evasion attempt via odbcconf.exe execution to load DLL
Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.
Looks for rare process launch as a scheduled task and activity done by the processes.
Author: Jouni Mikkola
More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Author: Jouni Mikkola
More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.
Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.
Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.
Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.
Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.
Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.
Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.
Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.
Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.
Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.
Page 2 of 3