WAB.exe DLL Hijacking via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects when the 'DLLPath' registry value for WAB.exe is modified to point to a DLL path different from the default one. WAB.exe is a legitimate Windows binary that can be abused to load arbitrary DLLs, a technique often used for defense evasion and persistence.