Detects WannaCry Ransomware BATCH File

Hunt Hypothesis

This detection rule identifies adversary behavior consistent with the initial execution phase of WannaCry ransomware by monitoring for suspicious Windows Batch file activities that often precede lateral movement and encryption. Proactively hunting for these artifacts in Azure Sentinel is critical because early identification of such batch scripts allows SOC teams to isolate compromised endpoints before the ransomware propagates across the network, even when individual events are flagged with low severity.

YARA Rule

rule WannCry_BAT {
   meta:
      description = "Detects WannaCry Ransomware BATCH File"
      author = "Florian Roth"
      reference = "https://goo.gl/HG2j5T"
      date = "2017-05-12"
      hash1 = "f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077"
   strings:
      $s1 = "@.exe\">> m.vbs" ascii
      $s2 = "cscript.exe //nologo m.vbs" fullword ascii
      $s3 = "echo SET ow = WScript.CreateObject(\"WScript.Shell\")> " ascii
      $s4 = "echo om.Save>> m.vbs" fullword ascii
   condition:
      ( uint16(0) == 0x6540 and filesize < 1KB and 1 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://goo.gl/HG2j5T
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects WannaCry Ransomware BATCH File rule in an enterprise environment:

• Windows Update Deployment via SCCM/MECM

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager deploys Windows updates to endpoints using a .bat script wrapper that invokes wusa.exe or msiexec. These scripts often execute in the background with high privilege, mimicking the file creation and execution patterns of the WannaCry worm.
  • Filter/Exclusion: Exclude batch files located within the default SCCM installation directory (e.g., C:\Windows\CCM\CcmExec) or filter by parent process name ccmexec.exe. Additionally, exclude scripts with file hashes that match known Microsoft-signed update deployment templates.

• Legacy Application Patching via Scheduled Tasks

  • Scenario: An organization runs a nightly maintenance job using Windows Task Scheduler to patch legacy line-of-business applications (e.g., Oracle Client or SAP GUI). The task triggers a custom .bat file located in C:\ProgramData\VendorName\Patches which performs version checks and executes installation commands.
  • Filter/Exclusion: Create an exclusion for batch files executed by the svchost.exe process (specifically the “Task Scheduler” service instance) where the file path contains known vendor directories or matches a specific naming convention (e.g., *_Patch_*.bat).

• Group Policy Software Installation Scripts

  • Scenario: During user logon, Group Policy Objects (GPOs) trigger startup scripts (Startup.bat) to install essential software suites like Adobe Acrobat Reader or Zoom. These scripts often run from the C:\Windows\SysWOW64\Scripts directory and perform file operations that resemble ransomware behavior before the user fully logs