odbcad32.exe

Launch odbcad32.exe GUI, click 'Tracing' tab, click 'Browsing' button, enter abitrary command in the File Dialog's path, press enter.

Use Execute a binary as a high-integrity process without a UAC prompt.

odbcad32.exe

Evidence

Upstream reference

Environment

Local host

Context

user

Native

UAC Bypass

MITRE

T1548.002

Detection

IOC: odbcad32.exe spawning unexpected child processes.

Refs

medium.com/@thebinaryhashira/living-off-the-land-and-living-above-uac-6a66738d225c

lolbas-project.github.io/lolbas/Binaries/odbcad32/