Odbcconf.exe is a Windows utility for configuring Open Database Connectivity (ODBC) drivers and data source names. The binary may be signed by Microsoft. MITRE ATT&CK tracks its abuse as T1218.008, Odbcconf, under System Binary Proxy Execution. The tactic is Stealth and the platform is Windows.
How attackers use it
Odbcconf.exe has a REGSVR flag, similar to Regsvr32, that can be misused to execute DLLs. Since the binary may be signed and native, it can slip past application control solutions that do not account for this behavior.
How to detect it
MITRE describes a three step chain to look for:
- Process creation of odbcconf.exe with REGSVR style arguments.
- A DLL load by odbcconf.exe of non-standard or unsigned modules.
- Optional follow-on process creation or network activity from the loaded DLL.
Process creation logs with command lines (Sysmon event ID 1, or Security event 4688) cover step one. Sysmon event ID 7 covers image loads for step two.
How to reduce the risk
- Remove or disable odbcconf.exe if it is not needed in your environment.
- Use application control to block its execution where it is not required.
Why it matters
Odbcconf is a tool most organizations barely use. That is good news, because the cleanest control is to remove it or block it. If you must keep it, the three step chain above gives you a detection with low noise, since a DLL load of an unsigned module by odbcconf.exe is rare in normal work.
Quick check
Which flag makes odbcconf.exe comparable to Regsvr32?
The REGSVR flag, which can be misused to execute DLLs.
Sources
- MITRE ATT&CK, T1218.008: https://attack.mitre.org/techniques/T1218/008
