AdaptixC2 Renamed WAB.exe Spawned via WMI (Bumblebee/Akira)

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•1

Detects execution of a renamed Windows Contacts utility (wab.exe) spawned by the WMI Provider Host (WmiPrvSE.exe). This pattern is indicative of masquarading and process injection, commonly used by threat actors to execute arbitrary code or establish C2 communication while appearing as a legitimate Windows binary.