← Back to SOC feed Coverage →

Detection for common strings of WannaDecryptor

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-11T11:00:01Z · Confidence: medium

Hunt Hypothesis

This hypothesis posits that adversaries are deploying WannaDecryptor ransomware variants by embedding characteristic file system strings within the environment to initiate encryption routines. The SOC team should proactively hunt for these specific artifacts in Azure Sentinel to identify early-stage infection indicators before they escalate into severe data exfiltration or widespread service disruption events.

YARA Rule

rule WannaDecryptor: WannaDecryptor
{
        meta:
                description = "Detection for common strings of WannaDecryptor"
 
        strings:
                $id1 = "taskdl.exe"
                $id2 = "taskse.exe"
                $id3 = "r.wnry"
                $id4 = "s.wnry"
                $id5 = "t.wnry"
                $id6 = "u.wnry"
                $id7 = "msg/m_"
 
        condition:
                3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 7 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the WannaDecryptor detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/RANSOM_MS17-010_Wannacrypt.yar