Execution DLL of Choice Using WAB.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.