← Back to SOC feed Coverage →

Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-05T23:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the detection identifies potential reconnaissance activity associated with the Symantec Waterbug attack, where an adversary may be using a legacy PDF-based trojan to establish initial access. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential long-term persistence and data exfiltration risks from outdated malware.

YARA Rule

rule WaterBug_wipbot_2013_core_PDF 
{

    meta:
        description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"
 
    strings:
        $PDF = "%PDF-"
        $a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/ 
        $b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
 
    condition:
        ($PDF at 0) and #a > 150 and #b > 200
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Waterbug.yar