ThreatFox: WannaCryptor IOCs

Hunt Hypothesis

This hunt targets adversary behavior consistent with the WannaCryptor ransomware campaign by actively searching for its specific indicators of compromise across the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to enable early detection and rapid containment before the malware can execute its encryption payload and disrupt business operations.

IOC Summary

Malware Family: WannaCryptor Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`161a0dc51f1dd79421194ab79236159ae994f688`	payload	2026-07-05	95%
md5_hash	`342f8fe9a988cbdb27f7756a2754549d`	payload	2026-07-05	95%
sha256_hash	`fc772ded09936960f85abe63e2162ac141d072eeb60d3f5a4c0e47f249c9b6a9`	payload	2026-07-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - WannaCryptor
let malicious_hashes = dynamic(["161a0dc51f1dd79421194ab79236159ae994f688", "342f8fe9a988cbdb27f7756a2754549d", "fc772ded09936960f85abe63e2162ac141d072eeb60d3f5a4c0e47f249c9b6a9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — WannaCryptor

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: WannaCryptor IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scheduled Antivirus Definition Updates via WSUS/SCCM
- Scenario: The organization uses Microsoft SCCM (Endpoint Configuration Manager) or WSUS to push security updates. During the nightly maintenance window (e.g., 02:00 UTC), these tools download and execute definition update packages that contain file hashes matching WannaCryptor’s known benign IOCs (specifically legitimate Microsoft-signed DLLs often re-used in ransomware families).
- Filter/Exclusion: Create a rule exclusion for the specific process paths associated with the update agents: C:\Program Files\Microsoft Intune Management Extension\IntuneManagementExtension.exe and C:\Windows\System32\usoclient.exe. Additionally, filter out alerts occurring strictly between 01:00 and 05:00 local time on these hosts.
Legacy Backup Agent Scanning Operations
- Scenario: The enterprise utilizes Veeam Backup & Replication or Commvault agents to perform incremental scans of critical file servers. These agents frequently spawn temporary worker processes that access and hash large volumes of data, triggering the “file creation” or “network connection” IOCs associated with WannaCryptor when scanning encrypted backup repositories.
- Filter/Exclusion: Exclude alerts where the parent process is VeeamAgent.exe (located in C:\Program Files\Veeam\Backup and Replication\Agent) or simagent.exe. Furthermore, add a filter to ignore network connections originating from these agents destined for known internal backup storage subnets (e.g., 10.50.x.x/24).
**Third-Party Endpoint Detection and