splunk_sysmon_T1218_odbcconf.txt

host=* "Odbcconf.exe"
| eval Time=strftime(_time, "%Y/%m/%d %H:%M:%S")
| stats values(Time) AS Time values(ComputerName) AS Computers values(User) AS User values(ProcessId) AS ProcessId values(ParentProcessId) AS ParentProcessId values(IntegrityLevel) AS IntegrityLevel values(OriginalFileName) AS OriginalFileName values(Image) AS ImageFileName values(CommandLine) AS CommandLine values(ParentImage) As ParentImage values(ParentCommandLine) AS ParentCommandLine dc(CommandLine) AS ThreatCount by Image,ComputerName
| eval Commands = lower(CommandLine)
| rex field=Commands mode=sed "s/\"//g"
| eval T1218_odbcconf=if(match((Commands),"(?i).*odbcconf.*(\/s|\/a).*"),7,0) 
| eval Execution_c= 'T1218_odbcconf'
| eval  Execution=Execution_c*ThreatCount
| addtotals fieldname=Score Execution
| table Time Computers User ProcessId ParentProcessId IntegrityLevel Score Execution T1218_odbcconf OriginalFileName ImageFileName Commands ParentImage ParentCommandLine
| sort Score desc