odbcad32.exe

type: OSBinaries

ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers.

Full path

c:\windows\system32\odbcad32.exe
c:\windows\syswow64\odbcad32.exe

Commands

UAC BypassUser T1548.002
Execute a binary as a high-integrity process without a UAC prompt.
```
odbcad32.exe
```
Launch odbcad32.exe GUI, click ‘Tracing’ tab, click ‘Browsing’ button, enter abitrary command in the File Dialog’s path, press enter.
os: Windows 10, Windows 11
Execute: CMDApplication: GUI

Detection

IOCodbcad32.exe spawning unexpected child processes.

Resources

https://medium.com/@thebinaryhashira/living-off-the-land-and-living-above-uac-6a66738d225c

acknowledgement: amonitoring, Ekitji @eki_erk