odbcad32.exe

ODBC Administrator file version info (xCyclopedia)

LOLBAS UAC Bypass 1 ATT&CK technique 1 documented command 12 known copies with hashes

How odbcad32.exe is abused

documented by LOLBAS

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for odbcad32.exe.

1 documented command

from LOLBAS, each read by the identifier

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control User privileges

Launch odbcad32.exe GUI, click 'Tracing' tab, click 'Browsing' button, enter abitrary command in the File Dialog's path, press enter.

odbcad32.exe

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for odbcad32.exe, by Ekitji, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for odbcad32.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Is it the real odbcad32.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionODBC Administrator

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\odbcad32.exe · signed by Microsoft Windows

2dee4a2e8442c67d5a4686486b82537060d6fb07120b36af33679934dde7d694

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\odbcad32.exe · signed by Microsoft Windows

5ccbd949626ecd38a0dd5096b8a9491dcd8001b2a6034b08fef5f05e83d07b5e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\odbcad32.exe · signed by Microsoft Windows

4d08777448e389ef4355918153fc40bbe8861b66d1f4e48cfdb68b9e9838875b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\odbcad32.exe · signed by Microsoft Windows

a7de309d8a5a68fb4623d41914ab5f03d6ff7bb2e0b5927afb402da137be6ca9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\odbcad32.exe · signed by Microsoft Windows

47f1c7ed7b339944dc1990e9d8c491c636c7dfe4683d9becf28b83e0f1524d71

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\odbcad32.exe · signed by Microsoft Windows

fbde7ab647d5a14e24454d1f2479d1b6844e910b9949f0e977eb3885946567e4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\odbcad32.exe · signed by Microsoft Windows

6e28c875bfa690d77cdc3fe2e9e1209ec9517034daede8bd28903e3fb6915d40

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\odbcad32.exe · signed by Microsoft Windows

e98522037ac6de502178b3db469c54c7f6f1fcdcaca302c96ed0a9cd1c2e3e45

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\odbcad32.exe · signed by Microsoft Windows

04375aba7e274a68c26e0bd70ae93f7b0b3b1fb7a9e757a368bddec36e31da18

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\odbcad32.exe · signed by Microsoft Windows

4b03b05fce5087633fae095e4fe95eda70eec93ac4840ef628f3fc508e7e0ae2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\odbcad32.exe · not signed

a47a68c48feb8e447198bdcdde309f97ebe64e5027c3162b270e46de71369bfb

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\odbcad32.exe · not signed

c1d93dabe45731aeafd0f932b3075c65a10ee6bc6fc0f70b850daecf051c1363

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.