From 3c1f60eb54f2c86d12dffaec60bb5a3e6c7afa2b Mon Sep 17 00:00:00 2001
From: 6en6ar <6en6ar@github.com>
Date: Thu, 8 Oct 2026 23:38:15 +0200
Subject: [PATCH 1/5] add wabmig.exe

---
 yml/OSBinaries/Wabmig.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 yml/OSBinaries/Wabmig.yml

diff --git a/yml/OSBinaries/Wabmig.yml b/yml/OSBinaries/Wabmig.yml
new file mode 100644
index 00000000..083c7a1e
--- /dev/null
+++ b/yml/OSBinaries/Wabmig.yml
@@ -0,0 +1,25 @@
+---
+Name: Wabmig.exe
+Description: Microsoft (R) Contacts Import Tool
+Author: 6en6ar
+Created: 2026-10-08
+Commands:
+  - Command: wabmig.exe
+    Description: Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice, rename it to wab32.dll
+    Usecase: Execute dll file. Bypass defensive counter measures
+    Category: Execute
+    Privileges: Administrator
+    MitreID: T1218
+    OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
+    Tags:
+      - Execute: DLL
+Full_Path:
+  - Path: C:\Program Files\Windows Mail\wabmig.exe
+Detection:
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml
+  - IOC: wabmig.exe should normally never be used
+Resources:
+  - Link: https://localh0st.run/post/windowsaddressbook/
+Acknowledgement:
+  - Person: Arnaut N.
+    Handle: '@6en6ar'
\ No newline at end of file

From 3dd4c9b1c345304925449be4cecdab5c17aa4133 Mon Sep 17 00:00:00 2001
From: 6en6ar <6en6ar@github.com>
Date: Thu, 8 Oct 2026 23:47:43 +0200
Subject: [PATCH 2/5] fix newline

---
 yml/OSBinaries/Wabmig.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/yml/OSBinaries/Wabmig.yml b/yml/OSBinaries/Wabmig.yml
index 083c7a1e..223a9eaa 100644
--- a/yml/OSBinaries/Wabmig.yml
+++ b/yml/OSBinaries/Wabmig.yml
@@ -22,4 +22,5 @@ Resources:
   - Link: https://localh0st.run/post/windowsaddressbook/
 Acknowledgement:
   - Person: Arnaut N.
-    Handle: '@6en6ar'
\ No newline at end of file
+    Handle: '@6en6ar'
+    
\ No newline at end of file

From a2bd0402cd58765e4de802a319254281cc05d9ad Mon Sep 17 00:00:00 2001
From: 6en6ar <6en6ar@github.com>
Date: Thu, 8 Oct 2026 23:49:27 +0200
Subject: [PATCH 3/5] fix newline and space

---
 yml/OSBinaries/Wabmig.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/yml/OSBinaries/Wabmig.yml b/yml/OSBinaries/Wabmig.yml
index 223a9eaa..06bcd97a 100644
--- a/yml/OSBinaries/Wabmig.yml
+++ b/yml/OSBinaries/Wabmig.yml
@@ -23,4 +23,3 @@ Resources:
 Acknowledgement:
   - Person: Arnaut N.
     Handle: '@6en6ar'
-    
\ No newline at end of file

From 2699c65a7d07c25f0b99d225a84a375127108fba Mon Sep 17 00:00:00 2001
From: 6en6ar <6en6ar@github.com>
Date: Thu, 8 Oct 2026 23:51:21 +0200
Subject: [PATCH 4/5] add x86 path

---
 yml/OSBinaries/Wabmig.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/yml/OSBinaries/Wabmig.yml b/yml/OSBinaries/Wabmig.yml
index 06bcd97a..0c33fac1 100644
--- a/yml/OSBinaries/Wabmig.yml
+++ b/yml/OSBinaries/Wabmig.yml
@@ -15,6 +15,7 @@ Commands:
       - Execute: DLL
 Full_Path:
   - Path: C:\Program Files\Windows Mail\wabmig.exe
+  - Path: C:\Program Files (x86)\Windows Mail\wabmig.exe
 Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml
   - IOC: wabmig.exe should normally never be used

From 96c533be3f9f5a6d3dbdadf1cba013c3c2a39376 Mon Sep 17 00:00:00 2001
From: 6en6ar <6en6ar@github.com>
Date: Fri, 9 Oct 2026 11:58:45 +0200
Subject: [PATCH 5/5] Add Build.bat pester script

---
 yml/OSScripts/Build_pester.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 yml/OSScripts/Build_pester.yml

diff --git a/yml/OSScripts/Build_pester.yml b/yml/OSScripts/Build_pester.yml
new file mode 100644
index 00000000..253bd0e6
--- /dev/null
+++ b/yml/OSScripts/Build_pester.yml
@@ -0,0 +1,22 @@
+---
+Name: Build.bat
+Description: Used as part of the Powershell pester testing framework
+Author: 6en6ar
+Created: 2026-09-26
+Commands:
+  - Command: Build.bat ;{PATH:.exe}
+    Description: Execute code using Build.bat. Example here executes specified executable.
+    Usecase: Proxy execution
+    Category: Execute
+    Privileges: User
+    MitreID: T1216
+    OperatingSystem: Windows 10, Windows 11
+    Tags:
+      - Execute: EXE
+Full_Path:
+  - Path: C:\Program Files\WindowsPowerShell\Modules\Pester\<VERSION>\Build.bat
+Resources:
+  - Link: https://devblogs.microsoft.com/scripting/what-is-pester-and-why-should-i-care/
+Acknowledgement:
+  - Person: Arnaut N.
+    Handle: '@6en6ar'