Wabot Trojan Worm

Hunt Hypothesis

This hunt targets the specific propagation patterns of the Wabot Trojan Worm to identify early-stage lateral movement and self-replication behaviors within the network. Proactively hunting for this low-severity threat in Azure Sentinel is critical to prevent silent worm outbreaks that could escalate into significant resource consumption and data exfiltration incidents before triggering standard alerts.

YARA Rule

rule Wabot : Worm
{
	meta:
		author="Kevin Falcoz"
		date="14/08/2015"
		description="Wabot Trojan Worm"

	strings:
		$signature1={43 3A 5C 6D 61 72 69 6A 75 61 6E 61 2E 74 78 74}
		$signature2={73 49 52 43 34}

	condition:
		$signature1 and $signature2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Wabot Trojan Worm detection rule in an enterprise environment, including suggested filters and exclusions:

• Enterprise Endpoint Protection Scans

  • Scenario: The Wabot worm is known to replicate across network shares. Legitimate scheduled scans by tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Sophos Intercept X often generate massive amounts of file I/O and process creation events when scanning shared drives (e.g., \\FileServer\Public). These activities can mimic the worm’s propagation behavior, triggering alerts on standard scan processes (MsMpEng.exe, CfSvcHost.exe) accessing network shares.
  • Suggested Filter: Exclude alert triggers where the parent process is a known EDR agent and the target path matches the organization’s standard backup or shared drive prefixes (e.g., paths starting with \\FileServer\ or \\Backup\). Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time).

• Automated Patch Management and Software Deployment

  • Scenario: During monthly patch cycles, tools like Microsoft SCCM (Configuration Manager), Ivanti, or Ansible push updates to thousands of endpoints. These deployment agents frequently copy executable files (setup.exe, msiexec) to local temp folders and network shares before execution, creating file creation and modification patterns that resemble the Wabot’s self-replication mechanism.
  • Suggested Filter: Create an exclusion rule for processes launched by known patch management services (e.g., ccmexec.exe for SCCM or AnsibleService) where the destination path is a temporary directory (e.g., %TEMP%, C:\Windows\SoftwareDistribution). Whitelist specific file hashes associated with standard deployment packages