Odbcconf on LOLBAS
Archived: 2026-04-06 00:49:19 UTC
.. /Odbcconf.exe
Used in Windows for managing ODBC connections
Paths:
C:\Windows\System32\odbcconf.exe
C:\Windows\SysWOW64\odbcconf.exe
Resources:
https://gist.github.com/NickTyrer/6ef02ce3fd623483137b45f65017352b
https://github.com/woanware/application-restriction-bypasses
https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Acknowledgements:
Casey Smith (@subtee)
Adam (@Hexacorn)
Detections:
Sigma: proc_creation_win_odbcconf_response_file.yml
Sigma: proc_creation_win_odbcconf_response_file_susp.yml
Elastic: defense_evasion_unusual_process_network_connection.toml
Elastic: defense_evasion_network_connection_from_windows_binary.toml
Execute
1. Execute DllRegisterServer from DLL specified.
odbcconf /a {REGSVR C:\Windows\Temp\file.dll}
Use case
Execute a DLL file using technique that can evade defensive counter measures
Privileges required
User
Operating systems
https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
Page 1 of 2

Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK® technique
T1218.008: Odbcconf
Tags
Execute: DLL
2. Install a driver and load the DLL. Requires administrator privileges.
odbcconf INSTALLDRIVER "lolbas-project|Driver=C:\Windows\Temp\file.dll|APILevel=2"
odbcconf configsysdsn "lolbas-project" "DSN=lolbas-project"
Use case
Execute dll file using technique that can evade defensive counter measures
Privileges required
User
Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK® technique
T1218.008: Odbcconf
Tags
Execute: DLL
3. Load DLL specified in target .RSP file. See the Code Sample section for an example .RSP file.
odbcconf -f file.rsp
Use case
Execute dll file using technique that can evade defensive counter measures
Privileges required
Administrator
Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
ATT&CK® technique
T1218.008: Odbcconf
Source: https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
Page 2 of 2