Suspicious Driver/DLL Installation Via Odbcconf.EXE

Title: Suspicious Driver/DLL Installation Via Odbcconf.EXE
Status: test
Description:Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  -https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
  -https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-23
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218.008'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\odbcconf.exe' OriginalFileName:'odbcconf.exe'   selection_cli:
    CommandLine|contains: 'INSTALLDRIVER '
  filter_main_dll_ext:
    CommandLine|contains: '.dll'
  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unlikely
Level: high