New ODBC Driver Registered

Hunt Hypothesis

Detects the registration of a new ODBC driver.

Detection Rule

Sigma (Original)

title: New ODBC Driver Registered
id: 3390fbef-c98d-4bdd-a863-d65ed7c610dd
status: test
description: Detects the registration of a new ODBC driver.
references:
    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-23
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\ODBC\ODBCINST.INI\'
        TargetObject|endswith: '\Driver'
    filter_main_sqlserver:
        TargetObject|contains: '\SQL Server\'
        Details: '%WINDIR%\System32\SQLSRV32.dll'
    filter_optional_office_access:
        TargetObject|contains: '\Microsoft Access '
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    filter_optional_office_excel:
        TargetObject|contains: '\Microsoft Excel Driver'
        Details|startswith: 'C:\Progra'
        Details|endswith: '\ACEODBC.DLL'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Likely
level: low

KQL (Azure Sentinel)

imRegistry
| where (RegistryKey endswith "\\SOFTWARE\\ODBC\\ODBCINST.INI*" and RegistryKey endswith "\\Driver") and (not((RegistryKey endswith "\\SQL Server*" and RegistryValueData =~ "%WINDIR%\\System32\\SQLSRV32.dll"))) and (not(((RegistryKey contains "\\Microsoft Access " and RegistryValueData startswith "C:\\Progra" and RegistryValueData endswith "\\ACEODBC.DLL") or (RegistryKey contains "\\Microsoft Excel Driver" and RegistryValueData startswith "C:\\Progra" and RegistryValueData endswith "\\ACEODBC.DLL"))))

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where (RegistryKey endswith "\\SOFTWARE\\ODBC\\ODBCINST.INI*" and RegistryKey endswith "\\Driver") and (not((RegistryKey endswith "\\SQL Server*" and RegistryValueData =~ "%WINDIR%\\System32\\SQLSRV32.dll"))) and (not(((RegistryKey contains "\\Microsoft Access " and RegistryValueData startswith "C:\\Progra" and RegistryValueData endswith "\\ACEODBC.DLL") or (RegistryKey contains "\\Microsoft Excel Driver" and RegistryValueData startswith "C:\\Progra" and RegistryValueData endswith "\\ACEODBC.DLL"))))

Required Data Sources

False Positive Guidance

• Likely

MITRE ATT&CK Context

• Tactic: Persistence

References

• https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
• SigmaHQ Rule