Sigma rule: Uncommon Child Process Spawned By Odbcconf.EXE

Rule

Title

Uncommon Child Process Spawned By Odbcconf.EXE

Status

test

Level

medium

Author

Harjot Singh @cyb3rjy0t

Date

2023-05-22

File

rules/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith: '\odbcconf.exe'
condition: selection

False positives (as the rule lists them)

• In rare occurrences where "odbcconf" crashes. It might spawn a "werfault" process
• Other child processes will depend on the DLL being registered by actions like "regsvr". In case where the DLLs have external calls (which should be rare). Other child processes might spawn and additional filters need to be applied.

Tags

• attack.stealth
• attack.t1218.008

MITRE ATT&CK ids this rule names

• T1218.008

References

• https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
• https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
• https://medium.com/@cyberjyot/t1218-008-dll-execution-using-odbcconf-exe-803fa9e08dac

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml