How can odbcconf.exe be used to bypass command-line monitoring of regsvr32 when loading DLLs?
By using the `/f` parameter of odbcconf.exe, you can pass a response file (`.rsp`) containing the `REGSVR` command with the DLL path. This avoids having the `regsvr` string in the command-line arguments visible to monitoring tools. For more details, see Study Notes Weekly No.3(Use odbcconf to load dll & Get-Exports & ETW USB Keylogger). This technique is similar to other bypass methods like using sdclt.exe to bypass UAC that also leverage alternate execution paths.
odbcconfregsvr32bypasscommand-line monitoringDLL loadingresponse file