New ODBC Driver Registered

Detects the registration of a new ODBC driver.

Detection logic

selection

TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\
TargetObject|endswith: \Driver

filter_main_sqlserver

TargetObject|contains: \SQL Server\
Details: "%WINDIR%\\System32\\SQLSRV32.dll"

filter_optional_office_access

TargetObject|contains: "\\Microsoft Access "
Details|startswith: C:\Progra
Details|endswith: \ACEODBC.DLL

filter_optional_office_excel

TargetObject|contains: \Microsoft Excel Driver
Details|startswith: C:\Progra
Details|endswith: \ACEODBC.DLL

Condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Raw YAML

title: New ODBC Driver Registered
id: 3390fbef-c98d-4bdd-a863-d65ed7c610dd
status: test
description: Detects the registration of a new ODBC driver.
references:
    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-23
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\ODBC\ODBCINST.INI\'
        TargetObject|endswith: '\Driver'
    filter_main_sqlserver:
        TargetObject|contains: '\SQL Server\'
        Details: '%WINDIR%\System32\SQLSRV32.dll'
    filter_optional_office_access:
        TargetObject|contains: '\Microsoft Access '
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    filter_optional_office_excel:
        TargetObject|contains: '\Microsoft Excel Driver'
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Likely
level: low

False positives

Likely

References

https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/

Similar rules

Activate Suppression of Windows Security Center Notifications

medium

windows · Same logsource category (registry_set)

Add Debugger Entry To AeDebug For Persistence

medium

windows · Same logsource category (registry_set)

Add Debugger Entry To Hangs Key For Persistence

high

windows · Same logsource category (registry_set)

Add DisallowRun Execution to Registry

medium

windows · Same logsource category (registry_set)