Odbcconf.EXE Suspicious DLL Location

Title: Odbcconf.EXE Suspicious DLL Location
Status: test
Description:Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.
References:
  -https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  -https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
  -https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-22
modified:2023-05-26
Tags:

• -'attack.stealth'
• -'attack.t1218.008'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\odbcconf.exe' OriginalFileName:'odbcconf.exe'   selection_cli:
    CommandLine|contains:
      -':\PerfLogs\'
      -':\ProgramData\'
      -':\Temp\'
      -':\Users\Public\'
      -':\Windows\Registration\CRMLog'
      -':\Windows\System32\com\dmp\'
      -':\Windows\System32\FxsTmp\'
      -':\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\'
      -':\Windows\System32\spool\drivers\color\'
      -':\Windows\System32\spool\PRINTERS\'
      -':\Windows\System32\spool\SERVERS\'
      -':\Windows\System32\Tasks_Migrated\'
      -':\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\'
      -':\Windows\SysWOW64\com\dmp\'
      -':\Windows\SysWOW64\FxsTmp\'
      -':\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\'
      -':\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\'
      -':\Windows\Tasks\'
      -':\Windows\Temp\'
      -':\Windows\Tracing\'
      -'\AppData\Local\Temp\'
      -'\AppData\Roaming\'

  condition:all of selection_*
Falsepositives:
  -Unlikely
Level: high