ATT&CK · T1218.008 · sub-technique
Odbcconf
Tactics: stealth
About
Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names. The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a <code>REGSVR</code> flag that can be misused to execute DLLs (ex: <code>odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}</code>).
Used by actors
1 known groups
Software
2 malware/tools implement this
Corpus indicators tagged with this technique
0 indicators in the corpus carry T1218.008.
No corpus indicators are tagged with this technique yet.