Query: detection rule: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.
Matching passage: Sigma rule: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.. Logsource: windows / process_creation. Rule: title: Suspicious Response File Execution Via Odbcconf.EXE id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5 related: - id: 5f03babb-12db-4eec-8c82-7b4cb5580868 type: derived - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e type: obsolete status: test description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension. references: - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16 - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|windash: ' -f ' filter_main_rsp_ext: CommandLine|contains: .rsp filter_main_runonce_odbc: ParentImage: C:\Windows\System32\runonce.exe Image: C:\Windows\System32\odbcconf.exe CommandLine|contains: .exe /E /F "C:\WINDOWS\system32\odbcconf.tmp" condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential. Logsource: windows / image_load. Rule: title: CredUI.DLL Loaded By Uncommon Process id: 9ae01559-cf7e-4f8e-8e14-4c290a1b4784 status: test description: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW". references: - https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password - https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa - https://github.com/S12cybersecurity/RDPCredentialStealer author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2026-06-29 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: category: image_load product: windows detection: selection: - ImageLoaded|endswith: - \credui.dll - \wincredui.dll - OriginalFileName: - credui.dll - wincredui.dll filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\SystemApps\ filter_main_full: Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\regedit.exe filter_optional_opera: Image|endswith: \opera_autoupdate.exe filter_optional_process_explorer: Image|endswith: - \procexp64.exe - \procexp64a.exe - \procexp.exe filter_optional_teams: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\Teams\ Image|endswith: \Teams.exe filter_optional_onedrive: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\OneDrive\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate processes loading those DLLs in your environment. level: medium