t1218-008-odbcconf

name	T1218.008_odbcconf
description	Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1218.008","defense-evasion","windows","sub-technique"]
technique_id	T1218.008
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1218/008
tech_stack	["windows"]
cwe_ids	["CWE-693"]
chains_with	["T1218","T1218.001","T1218.002","T1218.003","T1218.004","T1218.005","T1218.007","T1218.009","T1218.010","T1218.011","T1218.012","T1218.013","T1218.014","T1218.015"]
prerequisites	["T1218"]
severity_boost	{"T1218":"Chain with T1218 for deeper attack path","T1218.001":"Chain with T1218.001 for deeper attack path","T1218.002":"Chain with T1218.002 for deeper attack path"}

T1218.008 Odbcconf

Sub-technique of: T1218

High-Level Description

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names. The Odbcconf.exe binary may be digitally signed by Microsoft.

Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}).

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows

What to Check

• Identify if Odbcconf technique is applicable to target environment
• Check Windows systems for indicators of Odbcconf
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Odbcconf.exe - Execute Arbitrary DLL

Execute arbitrary DLL file stored locally.

Supported Platforms: windows

odbcconf.exe /S /A {REGSVR "#{dll_payload}"}

Dependencies:

• T1218-2.dll must exist on disk at specified location (#{dll_payload})

Atomic Test 2: Odbcconf.exe - Load Response File

Execute arbitrary response file that will spawn PowerShell.exe. Source files: https://github.com/woanware/application-restriction-bypasses

Supported Platforms: windows

cd "#{rsp_file_path}"
odbcconf.exe -f "#{rsp_file_name}"

Dependencies:

• T1218.008.rsp must exist on disk at specified location (#{rsp_file_path}#{rsp_file_name})

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by: