Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1218.008sub-technique of T1218 System Binary Proxy Execution

Odbcconf

Windowsnothing on this site yetT1218.008 on attack.mitre.org

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names. The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detecting Odbcconf Proxy Execution of Malicious DLLs

  • Identifies abuse of odbcconf.exe to execute malicious DLLs using the REGSVR command flag. Behavior chain: (1) Process creation of odbcconf.exe with /REGSVR or /A {REGSVR...} arguments → (2) DLL load by odbcconf.exe of non-standard or unsigned modules → (3) Optional follow-on process creation or network activity from...

what reduces it

  • M1038 Execution Prevention. Use application control configured to block execution of Odbcconf.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
  • M1042 Disable or Remove Feature or Program. Odbcconf.exe may not be necessary within a given environment.

the rest of T1218

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.