Execution DLL of Choice Using WAB.EXE

Title: Execution DLL of Choice Using WAB.EXE
Status: test
Description:This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.
References:
  -https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml
  -https://twitter.com/Hexacorn/status/991447379864932352
  -http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
Author: oscd.community, Natalia Shornikova
Date: 2020-10-13
modified:2023-08-17
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\Software\Microsoft\WAB\DLLPath'
  filter:
    Details: '%CommonProgramFiles%\System\wab32.dll'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high