Potentially Suspicious ODBC Driver Registered

Title: Potentially Suspicious ODBC Driver Registered
Status: test
Description:Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
References:
  -https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-23
modified:2023-08-17
Tags:

• -'attack.credential-access'
• -'attack.persistence'
• -'attack.t1003'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\SOFTWARE\ODBC\ODBCINST.INI\'
    TargetObject|endswith:
      -'\Driver'
      -'\Setup'

    Details|contains:
      -':\PerfLogs\'
      -':\ProgramData\'
      -':\Temp\'
      -':\Users\Public\'
      -':\Windows\Registration\CRMLog'
      -':\Windows\System32\com\dmp\'
      -':\Windows\System32\FxsTmp\'
      -':\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\'
      -':\Windows\System32\spool\drivers\color\'
      -':\Windows\System32\spool\PRINTERS\'
      -':\Windows\System32\spool\SERVERS\'
      -':\Windows\System32\Tasks_Migrated\'
      -':\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\'
      -':\Windows\SysWOW64\com\dmp\'
      -':\Windows\SysWOW64\FxsTmp\'
      -':\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\'
      -':\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\'
      -':\Windows\Tasks\'
      -':\Windows\Temp\'
      -':\Windows\Tracing\'
      -'\AppData\Local\Temp\'
      -'\AppData\Roaming\'

  condition:selection
Falsepositives:
  -Unlikely
Level: high