Wab.exe is the Windows Address Book executable, a legacy component that may still be present on some systems and can be abused as a trusted binary for process execution or evasion. Defenders should look for its presence on modern endpoints, unusual launches, and any activity that does not fit address book usage.
What Wab.exe Is and Why It Matters
Wab.exe is a legacy Windows executable that can blend into normal system activity because it is a trusted Microsoft binary. That makes it attractive for abuse when defenders are looking for signed tools used outside their intended purpose.
As with other living off the land binaries, the core issue is not the file name alone but the context of execution. A legitimate utility becomes suspicious when it appears on modern endpoints that should not need it, or when it is launched in a way that does not match its normal function.
How Wab.exe Is Abused
Attackers value trusted binaries because they can reduce friction, bypass weak allowlists, and make malicious behavior look like ordinary system administration. In practice, Wab.exe may be used as a launch point for code execution or as a way to hide activity inside a signed process lineage.
This pattern sits in the broader class of binary proxy execution, where the adversary uses a legitimate executable to run or stage something else. The abuse is often less about the binary's inherent capability and more about the trust defenders and endpoint controls place in it.
For defenders, the important distinction is between expected use and abuse. A process started from an unusual parent, invoked with strange arguments, or executed from an unexpected user session is more important than the filename on its own.
What Defenders Should Look For
Exposure begins with inventory. If Wab.exe exists on a system, teams should know whether that host still has a business reason to use it and whether the file is living in a location and condition consistent with the Microsoft-signed binary they expect.
Detection should focus on behavior, not only reputation. Hunt for unusual command lines, rare parent-child process relationships, execution from user-writable paths, and any sequence that suggests a trusted binary was used to start something unrelated to address book functionality.
Endpoint telemetry is especially useful when it is correlated with process creation logs, script execution, and application control events. That helps separate harmless legacy presence from a genuine execution chain that deserves investigation.
Containment, Hardening, and Review
If Wab.exe is unnecessary, the safest outcome is often to prevent it from running at all through application control or hardening baselines. Where it must remain, defenders should restrict where it can execute from, monitor its invocation closely, and treat any deviation from expected usage as a review trigger.
Modern endpoint policy should also be tested against related trusted-binary abuse patterns, not just this executable in isolation. Legacy utilities often survive longer than the workflows that once justified them, which creates an avoidable attack surface.
After suspicious activity, review the full execution chain and anything that may have been dropped, spawned, or modified around it. That is the practical way to determine whether Wab.exe was merely present or was part of a broader compromise path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1218 — System Binary Proxy Execution | Wab.exe abuse is a trusted-binary execution pattern within system binary proxy execution. |
| Recommendation — Map observed launches to T1218 and hunt for suspicious parent-child process chains around trusted binaries. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Behavioral detection of unusual launches and lineage depends on monitoring and analysis of system events. |
| CM-7 — Least Functionality | Removing unnecessary legacy binaries or restricting them aligns to minimizing exposed functionality. | |
| Recommendation — Alert on anomalous Wab.exe execution patterns in your system monitoring pipeline. Disable or remove Wab.exe where it is not required for business use. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Process creation and command-line auditing are central to spotting abuse of trusted binaries. |
| CIS-2 — Inventory and Control of Software Assets | Knowing whether Wab.exe should exist on endpoints requires software inventory and ownership. | |
| Recommendation — Collect and review process execution logs that reveal unexpected Wab.exe parent-child relationships. Inventory endpoints to confirm whether Wab.exe should be present and authorized. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org