.. /Wab.exe
Star

Windows address book manager

Paths:

C:\Program Files\Windows Mail\wab.exe
C:\Program Files (x86)\Windows Mail\wab.exe

Resources:

Acknowledgements:

Adam (@Hexacorn)

Detection:

Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml
IOC: WAB.exe should normally never be used

Execute

Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice
```
wab.exe
```
Use case
Execute dll file. Bypass defensive counter measures

Privileges required
Administrator

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1218