Odbcconf (5e434819-7f4a-440c-a9bd-7675c0218be1)
This object contains information sourced from the Living Off The Land Binaries, Scripts and Libraries (LOLBAS) project, which is licensed under GNU General Public License v3.0.
Description: Used in Windows for managing ODBC connections
Author: Oddvar Moe
Paths: * C:\Windows\System32\odbcconf.exe * C:\Windows\SysWOW64\odbcconf.exe
Resources: * https://gist.github.com/NickTyrer/6ef02ce3fd623483137b45f65017352b * https://github.com/woanware/application-restriction-bypasses * https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Detection: * Sigma: proc_creation_win_odbcconf_response_file.yml * Sigma: proc_creation_win_odbcconf_response_file_susp.yml * Elastic: defense_evasion_unusual_process_network_connection.toml * Elastic: defense_evasion_network_connection_from_windows_binary.toml[LOLBAS Odbcconf]
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Cobalt Group (58db02e6-d908-47c2-bc82-ed58ada61331) | Tidal Groups | Odbcconf (5e434819-7f4a-440c-a9bd-7675c0218be1) | Tidal Software | 1 |