Potentially Suspicious ODBC Driver Registered
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND (OBJECTNAME contains "\SOFTWARE\ODBC\ODBCINST.INI" OR (OBJECTNAME endswith "\SOFTWARE\ODBC\ODBCINST.INI" AND isExist(OBJECTVALUENAME))) AND OBJECTNAME endswith "\Driver,\Setup" AND INFORMATION contains ":\PerfLogs\,:\ProgramData\,:\Temp\,:\Users\Public\,:\Windows\Registration\CRMLog,:\Windows\System32\com\dmp\,:\Windows\System32\FxsTmp\,:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\,:\Windows\System32\spool\drivers\color\,:\Windows\System32\spool\PRINTERS\,:\Windows\System32\spool\SERVERS\,:\Windows\System32\Tasks_Migrated\,:\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\,:\Windows\SysWOW64\com\dmp\,:\Windows\SysWOW64\FxsTmp\,:\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\,:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\,:\Windows\Tasks\,:\Windows\Temp\,:\Windows\Tracing\,\AppData\Local\Temp\,\AppData\Roaming" select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
