.. / Wab.exe
Star

Windows address book manager


Paths:


Resources:
https://twitter.com/Hexacorn/status/991447379864932352
http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/

Acknowledgement:
Adam - @Hexacorn


Detection:
WAB.exe should normally never be used



Execute

Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice
wab.exe
Usecase:Execute dll file. Bypass defensive counter measures
Privileges required:Administrator
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218