What is the purpose of using odbcconf.exe with a response file to load a DLL that executes PowerShell commands?
NickTyrer extended odbcconf's DLL loading capability to execute PowerShell commands within the loaded DLL, using UnmanagedExports and System.Management.Automation. This allows stealthy code execution without triggering command-line detection of `regsvr` strings. For compilation instructions and details, refer to Study Notes Weekly No.3. This technique fits into the broader family of application whitelisting bypasses, such as using tracker.exe to load DLLs.
odbcconfPowerShellDLLcommand executionbypassUnmanagedExports