Windows Process Creation: wab.exe or wabmig.exe Run from Non-Default Paths
Alerts when wab.exe or wabmig.exe run from unexpected directories on Windows.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-12
- Updated
- 2026-07-30
What it detects
This rule flags process creation events where wab.exe or wabmig.exe are executed from paths other than the listed common Windows Mail directories. Attackers may abuse these legitimate Windows binaries to blend in with normal activity while running unwanted code. The detection relies on process creation telemetry, specifically the process image path ending in wab.exe or wabmig.exe and excluding executions from known default locations.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
- symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime
- thedfirreport.comhttps://thedfirreport.com/2022/09/26/bumblebee-round-two/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-wab-exe-or-wabmig-exe-run-from-non-default-paths-395907ee
title: "Windows Process Creation: wab.exe or wabmig.exe Run from Non-Default Paths"
id: 4eb58a13-371a-4e9a-b79f-969b228dc217
status: test
description: This rule flags process creation events where wab.exe or wabmig.exe are executed from paths other than the listed common Windows Mail directories. Attackers may abuse these legitimate Windows binaries to blend in with normal activity while running unwanted code. The detection relies on process creation telemetry, specifically the process image path ending in wab.exe or wabmig.exe and excluding executions from known default locations.
references:
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime
- https://thedfirreport.com/2022/09/26/bumblebee-round-two/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2022-09-27
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \wab.exe
- \wabmig.exe
filter:
Image|startswith:
- C:\Windows\WinSxS\
- C:\Program Files\Windows Mail\
- C:\Program Files (x86)\Windows Mail\
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 395907ee-96e5-4666-af2e-2ca91688e151
type: derived