T1218.008: Odbcconf
摘要
攻击者可能滥用 odbcconf.exe 代理执行恶意载荷。Odbcconf.exe 是一个 Windows 实用工具，允许你配置 Open Database Connectivity (ODBC) 驱动程序和数据源名称。(Citation: Microsoft odbcconf.exe) Odbcconf.exe 二进制文件可能由 Microsoft 数字签名。 攻击者可能滥用 odbcconf.exe 绕过未考虑其潜在滥用的应用程序控制解决方案。与 [Regsvr32](https://attack.mitre.org/techniques/T1218/010) 类似，odbcconf.exe 有一个 <code>REGSVR</code> 标志，可被误用于执行 DLL（例如：<code>odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}</code>）。(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
来源归属
来源：MITRE ATT&CK · 置信度：high
平台
- Windows
战术
Stealth
参考来源
- https://attack.mitre.org/techniques/T1218/008
- https://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses/
- https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/
- https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
- https://docs.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-2017