Windows: Unusual Process Tree for wab.exe and wabmig.exe

title: "Windows: Unusual Process Tree for wab.exe and wabmig.exe"
id: 220dd1d3-9299-487e-ad5b-285a7f8bad6e
status: test
description: This rule flags process creation events where wab.exe (Windows Contacts) or wabmig.exe (Microsoft Address Book Import Tool) appear in the process chain with unusual parent or child processes. Attackers may use these executables as part of stealthy execution, so identifying atypical parent-child relationships can help surface suspicious activity. The detection relies on Windows process creation telemetry, matching process image paths by their filename endings and correlating parent and child images.
references:
  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wab_unusual_parents.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2022-09-27
tags:
  - attack.execution
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \WmiPrvSE.exe
      - \svchost.exe
      - \dllhost.exe
    Image|endswith:
      - \wab.exe
      - \wabmig.exe
  selection_child:
    ParentImage|endswith:
      - \wab.exe
      - \wabmig.exe
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 63d1ccc0-2a43-4f4b-9289-361b308991ff
    type: derived