← Back to SOC feed Coverage →

Specific sample match for WannaCryptor

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-11T11:00:01Z · Confidence: medium

Hunt Hypothesis

This detection rule identifies the execution of known WannaCryptor ransomware samples within the environment to confirm the presence of this specific threat family. Proactively hunting for these matches in Azure Sentinel is essential because early identification allows the SOC team to isolate affected assets before lateral movement occurs, even when initial alerts are flagged with low severity.

YARA Rule

rule Wanna_Sample_84c82835a5d21bbcf75a61706d8ab549: Wanna_Sample_84c82835a5d21bbcf75a61706d8ab549
{
        meta:
                description = "Specific sample match for WannaCryptor"
                MD5 = "84c82835a5d21bbcf75a61706d8ab549"
                SHA1 = "5ff465afaabcbf0150d1a3ab2c2e74f3a4426467"
                SHA256 = "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa"
                INFO = "Looks for 'taskdl' and 'taskse' at known offsets"
 
        strings:
                $taskdl = { 00 74 61 73 6b 64 6c }
                $taskse = { 00 74 61 73 6b 73 65 }
 
        condition:
                $taskdl at 3419456 and $taskse at 3422953
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 2 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the WannaCryptor detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/RANSOM_MS17-010_Wannacrypt.yar