Wab.exe

Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice

Use Execute dll file. Bypass defensive counter measures

wab.exe

Context

admin

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml

IOC: WAB.exe should normally never be used

Refs

twitter.com/Hexacorn/status/991447379864932352

www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/

lolbas-project.github.io/lolbas/Binaries/Wab/