Suspicious Response File Execution Via Odbcconf.EXE

Rule Info

Tags
attack.defense_evasion DEMO attack.t1218.008
Name
Suspicious Response File Execution Via Odbcconf.EXE
Id
2d32dd6f-3196-4093-b9eb-1ad8ab088ca5
Date
2023-05-22 00:00:00
Modified
None
Description
Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.
Author
Nasreddine Bencherchali (Nextron Systems)
Type
Community Rule

Rule History

Title
Author
Commit
Date
feat: add/update rules related to odbcconf (#4228)
cyb3rjy0t
2023-05-23