Windows Process Creation: wab.exe or wabmig.exe Run from Non-Default Paths

title: "Windows Process Creation: wab.exe or wabmig.exe Run from Non-Default Paths"
id: 4eb58a13-371a-4e9a-b79f-969b228dc217
status: test
description: This rule flags process creation events where wab.exe or wabmig.exe are executed from paths other than the listed common Windows Mail directories. Attackers may abuse these legitimate Windows binaries to blend in with normal activity while running unwanted code. The detection relies on process creation telemetry, specifically the process image path ending in wab.exe or wabmig.exe and excluding executions from known default locations.
references:
  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2022-09-27
tags:
  - attack.execution
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \wab.exe
      - \wabmig.exe
  filter:
    Image|startswith:
      - C:\Windows\WinSxS\
      - C:\Program Files\Windows Mail\
      - C:\Program Files (x86)\Windows Mail\
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 395907ee-96e5-4666-af2e-2ca91688e151
    type: derived