EXPLORE
Sign In
← Back to Explore
sigmalowHunting

New ODBC Driver Registered

Detects the registration of a new ODBC driver.

Detection Query

selection:
  TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\
  TargetObject|endswith: \Driver
filter_main_sqlserver:
  TargetObject|contains: \SQL Server\
  Details: "%WINDIR%\\System32\\SQLSRV32.dll"
filter_optional_office_access:
  TargetObject|contains: "\\Microsoft Access "
  Details|startswith: C:\Progra
  Details|endswith: \ACEODBC.DLL
filter_optional_office_excel:
  TargetObject|contains: \Microsoft Excel Driver
  Details|startswith: C:\Progra
  Details|endswith: \ACEODBC.DLL
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

Author

Nasreddine Bencherchali (Nextron Systems)

Created

2023-05-23

Data Sources

windowsRegistry Set Events

Platforms

windows

References

Tags

attack.persistence
Raw Content
title: New ODBC Driver Registered
id: 3390fbef-c98d-4bdd-a863-d65ed7c610dd
status: test
description: Detects the registration of a new ODBC driver.
references:
    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-23
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\ODBC\ODBCINST.INI\'
        TargetObject|endswith: '\Driver'
    filter_main_sqlserver:
        TargetObject|contains: '\SQL Server\'
        Details: '%WINDIR%\System32\SQLSRV32.dll'
    filter_optional_office_access:
        TargetObject|contains: '\Microsoft Access '
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    filter_optional_office_excel:
        TargetObject|contains: '\Microsoft Excel Driver'
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Likely
level: low