Wab Execution From Non-Default Location
Detects the execution of 'wab.exe' (Windows Contacts) and 'wabmig.exe' (Microsoft Address Book Import Tool) when they are launched from non-default, suspicious locations. This behavior has been observed in campaigns involving the Bumblebee loader, where these legitimate Windows executables are abused for malicious purposes, often as part of defense evasion or execution tactics.
Sigma
