AdaptixC2 Renamed WAB.exe (AdgNsy.exe) Spawned via WMI from AppData
Detects the execution of a renamed Windows Address Book (WAB.exe) binary, observed as AdgNsy.exe, originating from an AppData local directory and spawned by WmiPrvSE.exe. This pattern is indicative of AdaptixC2 beaconing activity, leveraging WMI for execution to maintain persistence or conduct remote operations under the guise of a legitimate system utility.
Sigma
