Detects WannaCry Ransomware on Disk and in Virtual Page

Hunt Hypothesis

This hunt hypothesis targets adversaries executing WannaCry ransomware by identifying its specific file encryption patterns across both physical disk storage and virtual memory pages. Proactively hunting for these indicators within Azure Sentinel is critical to validate the rule’s sensitivity against false positives and ensure early detection of lateral movement before widespread data encryption occurs.

YARA Rule

rule Wanna_Cry_Ransomware_Generic {
       meta:
              description = "Detects WannaCry Ransomware on Disk and in Virtual Page"
              author = "US-CERT Code Analysis Team"
              reference = "not set"                                        
              date = "2017/05/12"
       hash0 = "4DA1F312A214C07143ABEEAFB695D904"
       strings:
              $s0 = {410044004D0049004E0024}
              $s1 = "WannaDecryptor"
              $s2 = "WANNACRY"
              $s3 = "Microsoft Enhanced RSA and AES Cryptographic"
              $s4 = "PKS"
              $s5 = "StartTask"
              $s6 = "wcry@123"
              $s7 = {2F6600002F72}
              $s8 = "unzip 0.15 Copyrigh"
              $s9 = "Global\\WINDOWS_TASKOSHT_MUTEX"        
              $s10 = "Global\\WINDOWS_TASKCST_MUTEX"   
             $s11 = {7461736B736368652E657865000000005461736B5374617274000000742E776E7279000069636163}
             $s12 = {6C73202E202F6772616E742045766572796F6E653A46202F54202F43202F5100617474726962202B68}
             $s13 = "WNcry@2ol7"
             $s14 = "wcry@123"
             $s15 = "Global\\MsWinZonesCacheCounterMutexA"
       condition:
              $s0 and $s1 and $s2 and $s3 or $s4 and $s5 and $s6 and $s7 or $s8 and $s9 and $s10 or $s11 and $s12 or $s13 or $s14 or $s15
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 16 string patterns in its detection logic.

References

• not set
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the WannaCry Ransomware detection rule, including context and recommended exclusions:

• Enterprise Antivirus Scheduled Scans

  • Scenario: During off-peak hours (e.g., 2:00 AM), enterprise endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform deep disk scans. These agents often create temporary memory-mapped files and scan virtual page tables to verify integrity, mimicking the file access patterns of WannaCry’s initial infection phase.
  • Filter/Exclusion: Exclude processes with known benign parent executables (e.g., MsMpEng.exe, CrowdStrikeService.exe) and restrict the rule trigger to only flag activity originating from unknown or unsigned binaries in non-standard directories.

• Windows Update and Patch Deployment Jobs

  • Scenario: The WSUS (Windows Server Update Services) agent or Microsoft Endpoint Configuration Manager (MECM/SCCM) executes scheduled patch installation tasks. These jobs frequently modify system files, update the registry, and interact with virtual memory pages to apply hotfixes, generating I/O signatures similar to ransomware encryption activities.
  • Filter/Exclusion: Create an exclusion for the specific process names WuApp.exe, ccmexec.exe, and TrustedInstaller (TiWorker) when running under the context of a scheduled task named “Windows Update” or “Software Center”.

• Backup Software Snapshot Operations

  • Scenario: Enterprise backup solutions such as Veeam Backup & Replication, Commvault, or Acronis Cyber Backup initiate snapshot jobs. These tools often lock files, read virtual page tables to ensure data consistency before creating a point-in-time copy, which can be misinterpreted by the rule as the rapid file locking