Execution DLL of Choice Using WAB.EXE

Status: test
Severity: high
Log source: category registry_set, product windows
Author: oscd.community, Natalia Shornikova
Source: github.com/SigmaHQ/sigma

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Execution DLL of Choice Using WAB.EXE
id: fc014922-5def-4da9-a0fc-28c973f41bfb
status: test
description: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.
references:
    - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml
    - https://twitter.com/Hexacorn/status/991447379864932352
    - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
author: oscd.community, Natalia Shornikova
date: 2020-10-13
modified: 2023-08-17
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\Microsoft\WAB\DLLPath'
    filter:
        Details: '%CommonProgramFiles%\System\wab32.dll'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    TargetObject|endswith: '\Software\Microsoft\WAB\DLLPath'

Stage 2: `not filter`

filter:
    Details: '%CommonProgramFiles%\System\wab32.dll'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Details`	eq	`%CommonProgramFiles%\System\wab32.dll`	`excludes:Details` `field:"Details" value:"%CommonProgramFiles%\System\wab32.dll"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\Software\Microsoft\WAB\DLLPath`	`field:"TargetObject" kind:ends_with value:"\Software\Microsoft\WAB\DLLPath"`