Windows Remote Thread Creation via rundll32.exe from wabmig.exe or wab.exe

title: Windows Remote Thread Creation via rundll32.exe from wabmig.exe or wab.exe
id: 12e17dcf-074b-42e0-8bb2-57ac17fdb2fa
status: test
description: This rule flags remote thread creation on Windows when the target image is rundll32.exe and the source image ends with wabmig.exe, wab.exe, or ImagingDevices.exe. Attackers may use this pattern to execute code in the context of a different process, increasing stealth and complicating analysis. It relies on telemetry that records create_remote_thread events along with the originating and target process image paths.
references:
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Bumblebee/create_remote_thread_win_malware_bumblebee.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-27
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218.011
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    SourceImage|endswith:
      - \wabmig.exe
      - \wab.exe
      - \ImagingDevices.exe
    TargetImage|endswith: \rundll32.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 994cac2b-92c2-44bf-8853-14f6ca39fbda
    type: derived