Wab.exe

Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice

Use Execute dll file. Bypass defensive counter measures

wab.exe

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml

IOC: WAB.exe should normally never be used

Refs

twitter.com/Hexacorn/status/991447379864932352

www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/

lolbas-project.github.io/lolbas/Binaries/Wab/