Identifier / Programs / Windows

odbcconf.exe

ODBC Driver Configuration Program file version info (xCyclopedia)

LOLBAS Execute 10 Sigma rules name it 1 ATT&CK technique 3 documented commands 12 known copies with hashes

How odbcconf.exe is abused

documented by LOLBAS

Execute T1218.008 System Binary Proxy Execution: Odbcconf

-a

Execute T1218.008 System Binary Proxy Execution: Odbcconf

installdriver configsysdsn

Execute T1218.008 System Binary Proxy Execution: Odbcconf

-f

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for odbcconf.exe.

3 documented commands

from LOLBAS, each read by the identifier

Execute T1218.008 System Binary Proxy Execution: Odbcconf User privileges

Execute DllRegisterServer from DLL specified.

odbcconf /a {REGSVR {PATH_ABSOLUTE:.dll}}

Identify

Trips 1 Sigma rule: mediumNew DLL Registered Via Odbcconf.EXE by Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Execute T1218.008 System Binary Proxy Execution: Odbcconf User privileges

Install a driver and load the DLL. Requires administrator privileges.

odbcconf INSTALLDRIVER "lolbas-project|Driver={PATH_ABSOLUTE:.dll}|APILevel=2"
odbcconf configsysdsn "lolbas-project" "DSN=lolbas-project"

Identify

Trips 1 Sigma rule: mediumDriver/DLL Installation Via Odbcconf.EXE by Nasreddine Bencherchali (Nextron Systems)

Execute T1218.008 System Binary Proxy Execution: Odbcconf Administrator privileges

Load DLL specified in target .RSP file. See the Code Sample section for an example .RSP file.

odbcconf -f {PATH:.rsp}

Identify

Trips 1 Sigma rule: mediumResponse File Execution Via Odbcconf.EXE by Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)

All 3 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for odbcconf.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for odbcconf.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSuspicious Driver/DLL Installation Via Odbcconf.EXENasreddine Bencherchali (Nextron Systems)

highOdbcconf.EXE Suspicious DLL LocationNasreddine Bencherchali (Nextron Systems)

highPotentially Suspicious DLL Registered Via Odbcconf.EXENasreddine Bencherchali (Nextron Systems)

highSuspicious Response File Execution Via Odbcconf.EXENasreddine Bencherchali (Nextron Systems)

mediumDriver/DLL Installation Via Odbcconf.EXENasreddine Bencherchali (Nextron Systems)

mediumNew DLL Registered Via Odbcconf.EXEKirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)

mediumResponse File Execution Via Odbcconf.EXEKirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious ShellExec_RunDLL Call Via OrdinalSwachchhanda Shrawan Poudel

T1218.008System Binary Proxy Execution: Odbcconf

Is it the real odbcconf.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionODBC Driver Configuration Program

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\odbcconf.exe · signed by Microsoft Windows

1c6a0c26bc6ec180b0121f61cff4ffd88a24790ac1718b8edcbbeb7115d44cc7

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\odbcconf.exe · signed by Microsoft Windows

e181c538c72cd7b82f3081a1039042a05637f926665e6b7f5aaf61f5f8c7decf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\odbcconf.exe · signed by Microsoft Windows

476346234300504cccf360ef8172b4e07cca59b43b7f09818b11b71210df3481

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\odbcconf.exe · signed by Microsoft Windows

5213c43c38d85ba69b406f27fa1a2505173dea529010bf6dd34049e9cc9dc01a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\odbcconf.exe · signed by Microsoft Windows

1fe23fab90945a9c7ee6029fd953bf9360544127444b71620da6852c408dd04e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\odbcconf.exe · signed by Microsoft Windows

e626fa3db43757af2aeff442847ca68402929d826da9160692b6220338fbdeb8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\odbcconf.exe · signed by Microsoft Windows

40274d2b55355d30230cee9c75335290c0692f6d7cfe5faa529a582d9cdaa232

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\odbcconf.exe · signed by Microsoft Windows

82984508d7814caf0e73d70aba19359297cf23a53ff1ac891bcb84b803321858

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\odbcconf.exe · signed by Microsoft Windows

60da7053b6509a1b5b4c443901ec520f34142edd61b2de5092d1ee8276c37e2d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\odbcconf.exe · signed by Microsoft Windows

ff2e62d70d06f1ca9fc38cdb5ec78a2a1d8ef315027f2459a74e707e5d4069f2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\odbcconf.exe · not signed

2a39e4fcf0c717ad073104f2c6c37a39f6fef6db427a8be9aa33224a5befc668

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\odbcconf.exe · not signed

a938a6f437c40becfe407ad7d5ecaa9ef2169f29a77ca978deabf3c388f986a1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

odbcconf.exe

How odbcconf.exe is abused

3 documented commands

What detects it

Is it the real odbcconf.exe?

12 known copies

Other programs abused for Execute