CmdID / Techniques / T1218

T1218.008 System Binary Proxy Execution: Odbcconf

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. MITRE ATT&CK

1 program on CmdID 7 Sigma rules T1218.008 on attack.mitre.org

Part of

MITRE ATT&CK

T1218System Binary Proxy Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

odbcconf.exeExecute

Sigma rules tagged with it

process creation, the highest levels first

highOdbcconf.EXE Suspicious DLL LocationNasreddine Bencherchali (Nextron Systems) · Windows

highPotentially Suspicious DLL Registered Via Odbcconf.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Driver/DLL Installation Via Odbcconf.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Response File Execution Via Odbcconf.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumDriver/DLL Installation Via Odbcconf.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumNew DLL Registered Via Odbcconf.EXEKirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumResponse File Execution Via Odbcconf.EXEKirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows