Client-Side Container Attack: DLL Sideloading wab.exe via Email Archive Delivery

Original text: “Initial access. Client side container attack” — Leigh Gilbert, Exploitz (exploitz.ca, June 2026). The diagrams below are reproduced with attribution; prose is paraphrased. MITRE ATT&CK reference: T1574.001 — DLL Search Order Hijacking.

Executive Summary

Leigh Gilbert’s walkthrough chains together a long-known but still effective initial-access pattern: ship a signed Microsoft binary that has…

https://core-jmp.org/2026/06/client-side-container-attack-dll-sideloading-wab-exe-email-archive/