← Back to SOC feed Coverage →

Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-05T23:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential lateral movement or data exfiltration behavior associated with the Symantec Waterbug attack, leveraging the Trojan.Wipbot 2014 Down.dll component. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate legacy threat actors using outdated malware components that may still persist in modern environments.

YARA Rule

rule WaterBug_wipbot_2013_dll 
{

    meta:
        description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"        
  
    strings:
        $string1 = "/%s?rank=%s"
        $string2 = "ModuleStart\x00ModuleStop\x00start"
        $string3 = "1156fd22-3443-4344-c4ffff"
        //read file... error..
        $string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
  
    condition:
        2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Waterbug.yar