WannaCry SMB Exploit

Hunt Hypothesis

This detection identifies lateral movement attempts where adversaries exploit vulnerable SMB services to propagate ransomware payloads across internal networks. Proactive hunting in Azure Sentinel is critical to validate patch compliance and detect early-stage infection chains before they escalate into widespread encryption events.

YARA Rule

rule WannaCry_SMB_Exploit
{
 meta:
 	description = "WannaCry SMB Exploit"
 	reference = "https://www.cylance.com/en_us/blog/threat-spotlight-inside-the-wannacry-attack.html"
 	date = "2017-05-12"
 
 strings:
 	$s1 = { 53 4D 42 72 00 00 00 00 18 53 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE 00 00 40 00 00 62 00 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 52 41 4D 20 31 2E 30 00 02 4C 41 4E 4D 41 4E 31 2E 30 00 02 57 69 6E 64 6F 77 73 20 66 6F 72 20 57 6F 72 6B 67 72 6F 75 70 73 20 33 2E 31 61 00 02 4C 4D 31 2E 32 58 30 30 32 00 02 4C 41 4E 4D 41 4E 32 2E 31 00 02 4E 54 20 4C 4D 20 30 2E 31 32 00 00 00 00 00 00 00 88 FF 53 4D 42 73 00 00 00 00 18 07 C0 }
 
 condition:
 	uint16(0) == 0x5a4d and filesize < 4MB and all of them and pe.imports("ws2_32.dll", "connect") and pe.imports("ws2_32.dll", "send") and pe.imports("ws2_32.dll", "recv") and pe.imports("ws2_32.dll", "socket") and pe.imports("ws2_32.dll", "closesocket")
 }
 
 rule wannacry_static_ransom : wannacry_static_ransom {

meta:

description = "Detects WannaCryptor spreaded during 2017-May-12th campaign and variants"

author = "Blueliv"

reference = "https://blueliv.com/research/wannacrypt-malware-analysis/"

date = "2017-05-15"

strings:

$mutex01 = "Global\\MsWinZonesCacheCounterMutexA" ascii

$lang01 = "m_bulgarian.wnr" ascii

$lang02 = "m_vietnamese.wnry" ascii

$startarg01 = "StartTask" ascii

$startarg02 = "TaskStart" ascii

$startarg03 = "StartSchedule" ascii

$wcry01 = "WanaCrypt0r" ascii wide

$wcry02 = "WANACRY" ascii

$wcry03 = "WANNACRY" ascii

$wcry04 = "WNCRYT" ascii wide

$forig01 = ".wnry\x00" ascii

$fvar01 = ".wry\x00" ascii

condition:

($mutex01 or any of ($lang*)) and ( $forig01 or all of ($fvar*) ) and any of ($wcry*) and any of ($startarg*)

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://www.cylance.com/en_us/blog/threat-spotlight-inside-the-wannacry-attack.html
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the WannaCry SMB Exploit detection rule in an enterprise environment, along with targeted filters or exclusions:

• Internal Patch Management Scans

  • Scenario: Automated vulnerability scanners (e.g., Tenable Nessus, Qualys, or Microsoft SCCM) perform routine SMB enumeration and version checks against endpoints to verify patch levels. These scans often trigger the specific SMB handshake patterns associated with the exploit even when no actual exploitation is occurring.
  • Filter/Exclusion: Create an exclusion rule for source IPs belonging to the vulnerability management subnet (e.g., 10.20.50.x) and restrict alerts to only those originating from external networks or non-scanner internal subnets.

• Scheduled Antivirus Definition Updates

  • Scenario: Enterprise endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint utilize SMB protocols to pull definition updates and policy configurations from central management servers during off-hours maintenance windows. The high-volume file transfer activity can mimic the exploit’s network behavior.
  • Filter/Exclusion: Exclude traffic where the destination port is 445 (SMB) and the source process name matches known AV update agents (e.g., CrowdStrikeService.exe, MsMpEng.exe) running on scheduled tasks between 02:00 and 04:00 local time.

• Administrative File Replication Tasks

  • Scenario: System administrators or automated scripts using tools like Robocopy, rsync, or PowerShell (Copy-Item) perform large-scale file synchronization between domain controllers and file servers. These legitimate bulk data transfers generate the same SMB connection spikes that the rule flags as potential exploit attempts.
  • Filter/Exclusion: Implement