Uncommon Child Process Spawned By Odbcconf.EXE — Sigma Rule

Rule metadata and linked tags

Author: Harjot Singh @cyb3rjy0t. Source status: test; severity: medium. Source dates: 2023-05-22 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 4cf9879d4bee9e6138b4b0e2fb469459642841f5d13c7ad91ae0b10842e1875b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Uncommon Child Process Spawned By Odbcconf.EXE
id: 8e3c7994-131e-4ba5-b6ea-804d49113a26
status: test
description: Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.
references:
    - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
    - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
    - https://medium.com/@cyberjyot/t1218-008-dll-execution-using-odbcconf-exe-803fa9e08dac
author: Harjot Singh @cyb3rjy0t
date: 2023-05-22
tags:
    - attack.stealth
    - attack.t1218.008
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\odbcconf.exe'
    condition: selection
falsepositives:
    - In rare occurrences where "odbcconf" crashes. It might spawn a "werfault" process
    - Other child processes will depend on the DLL being registered by actions like "regsvr". In case where the DLLs have external calls (which should be rare). Other child processes might spawn and additional filters need to be applied.
level: medium

Original YAML and metadata in JSON

False positives

• In rare occurrences where "odbcconf" crashes. It might spawn a "werfault" process
• Other child processes will depend on the DLL being registered by actions like "regsvr". In case where the DLLs have external calls (which should be rare). Other child processes might spawn and additional filters need to be applied.

Source references

• https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
• https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
• https://medium.com/@cyberjyot/t1218-008-dll-execution-using-odbcconf-exe-803fa9e08dac