Wab.exe

Commands

1. ExecuteAdministrator T1218

   Execute dll file. Bypass defensive counter measures

   wab.exe

   Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   Execute: DLL

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml
• IOCWAB.exe should normally never be used

Resources

• https://twitter.com/Hexacorn/status/991447379864932352
• http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/