T1218.008 — Odbcconf

Tactic: Stealth · Platforms: Windows

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names. The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.008 System Binary Proxy Execution: Odbcconf

title: "T1218.008 System Binary Proxy Execution: Odbcconf"
id: f83ad1ba-0742-4964-9603-dc80f69cf450
description: 'Detecting Odbcconf Proxy Execution of Malicious DLLs via the REGSVR Flag. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcessName, AllowedCommandPatterns, TimeWindow, ApprovedModuleHashes.'
references:
  - https://attack.mitre.org/techniques/T1218/008
author: Shahrukh Khan
date: 2026-04-06
license: MIT
tags:
  - attack.stealth
  - attack.t1218.008

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    EventID: '1'
    Image|endswith: '\odbcconf.exe'
    CommandLine|contains: 'REGSVR'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate ODBC driver registration by administrators using the REGSVR flag.

level: medium

Related sub-techniques

Explore