System Binary Proxy Execution: Odbcconf

Created the Sunday 05 March 2023. Updated 6 months, 3 weeks ago.

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names. The Odbcconf.exe binary may be digitally signed by Microsoft.

Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"})

Technique Identifier

T1218.008

Technique Tags

Defense Evasion Open Database Connectivity (ODBC) bypass application control solutions REGSVR execution of malicious DLL files

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

System Binary Proxy Execution: Odbcconf, Sub-technique T1218.008 - Enterprise | MITRE ATT&CK®