Elastic Defend high stable eql

Suspicious ImageLoad via ODBC Driver Configuration Program

Identifies abuse of the ODBC Driver Configuration Program to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.

View Source

Detection Logic

process where event.action == "start" and
  (process.pe.original_file_name == "odbcconf.exe" or process.name : "odbcconf.exe") and
   process.args : ("-a", "-f", "/a", "/f") and
   not (process.args : "?:\\Windows\\SysWOW64\\ODBCCONF.RSP" and process.parent.name : "InstallManager.exe") and
   not (process.args : "{CONFIGSYSDSN*" and process.Ext.token.integrity_level_name : ("high", "system")) and 
   not process.args: ("SQL Server", "C:\\WINDOWS\\system32\\odbcconf.tmp")

Field Validations

Loading…

Comments (0)

Loading comments...