LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Wab.exe

View source

Windows address book manager

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice

COMMAND
wab.exe
USE CASE
Execute dll file. Bypass defensive counter measures
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Program Files\Windows Mail\wab.exe
C:\Program Files (x86)\Windows Mail\wab.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    WAB.exe should normally never be used

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam@Hexacorn