MITRE ATT&CKsub-technique

T1218.008 Odbcconf

Published 2020-01-24 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Windows
Version
3.0
Created
2020-01-24

Description

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names. The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1218 System Binary Proxy Execution technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1038 Execution Prevention mitigation
  • M1042 Disable or Remove Feature or Program mitigation

Referenced by MITRE ATT&CK · uses (3)

  • S1130 Raspberry Robin software (malware)
  • S1039 Bumblebee software (malware)
  • G0080 Cobalt Group group

Referenced by Compliance · mitigates (12)

  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References