Windows: Unusual Process Tree for wab.exe and wabmig.exe
Alert on abnormal parent/child process relationships involving wab.exe and wabmig.exe in Windows process creation logs.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-12
- Updated
- 2026-07-30
What it detects
This rule flags process creation events where wab.exe (Windows Contacts) or wabmig.exe (Microsoft Address Book Import Tool) appear in the process chain with unusual parent or child processes. Attackers may use these executables as part of stealthy execution, so identifying atypical parent-child relationships can help surface suspicious activity. The detection relies on Windows process creation telemetry, matching process image paths by their filename endings and correlating parent and child images.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
- symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime
- thedfirreport.comhttps://thedfirreport.com/2022/09/26/bumblebee-round-two/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wab_unusual_parents.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Unusual Process Tree for wab.exe and wabmig.exe"
id: 220dd1d3-9299-487e-ad5b-285a7f8bad6e
status: test
description: This rule flags process creation events where wab.exe (Windows Contacts) or wabmig.exe (Microsoft Address Book Import Tool) appear in the process chain with unusual parent or child processes. Attackers may use these executables as part of stealthy execution, so identifying atypical parent-child relationships can help surface suspicious activity. The detection relies on Windows process creation telemetry, matching process image paths by their filename endings and correlating parent and child images.
references:
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime
- https://thedfirreport.com/2022/09/26/bumblebee-round-two/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wab_unusual_parents.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2022-09-27
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \WmiPrvSE.exe
- \svchost.exe
- \dllhost.exe
Image|endswith:
- \wab.exe
- \wabmig.exe
selection_child:
ParentImage|endswith:
- \wab.exe
- \wabmig.exe
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 63d1ccc0-2a43-4f4b-9289-361b308991ff
type: derived