Detection rules › Sigma
Wab Execution From Non Default Location
Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
| Security-Auditing | 4688 | A new process has been created. |
Stages and Predicates
Stage 1: selection
or:
Image|endswith: '\wab.exe'
Image|endswith: '\wabmig.exe'
Stage 2: not filter
or:
Image|startswith: 'C:\Program Files (x86)\Windows Mail\'
Image|startswith: 'C:\Program Files\Windows Mail\'
Image|startswith: 'C:\Windows\WinSxS\'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | ends_with |
|
Image | starts_with |
|
Neighbors
Stricter alternatives (narrower than this rule)
The rules below may be useful if you find the current rule is too noisy / lacks specificity.
- Wab/Wabmig Unusual Parent Or Child Processes (adds 1 filter)