Probable PETYA ransomware using ETERNALBLUE, WMIC, PsExec

Hunt Hypothesis

This hunt targets adversaries leveraging the EternalBlue exploit alongside WMIC and PsExec to propagate PETYA ransomware across a network, mimicking lateral movement patterns typical of large-scale outbreaks. Proactively hunting for these specific execution chains in Azure Sentinel is critical because early detection allows teams to isolate compromised hosts before the ransomware encrypts critical data, even when initial alert severity is low.

YARA Rule

rule FE_CPE_MS17_010_RANSOMWARE {
meta:version="1.1"
      //filetype="PE"
      author="Ian.Ahl@fireeye.com @TekDefense, Nicholas.Carr@mandiant.com @ItsReallyNick"
      date="2017-06-27"
      description="Probable PETYA ransomware using ETERNALBLUE, WMIC, PsExec"
      reference = "https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html"
strings:
      // DRIVE USAGE
      $dmap01 = "\\\\.\\PhysicalDrive" nocase ascii wide
      $dmap02 = "\\\\.\\PhysicalDrive0" nocase ascii wide
      $dmap03 = "\\\\.\\C:" nocase ascii wide
      $dmap04 = "TERMSRV" nocase ascii wide
      $dmap05 = "\\admin$" nocase ascii wide
      $dmap06 = "GetLogicalDrives" nocase ascii wide
      $dmap07 = "GetDriveTypeW" nocase ascii wide

      // RANSOMNOTE
      $msg01 = "WARNING: DO NOT TURN OFF YOUR PC!" nocase ascii wide
      $msg02 = "IF YOU ABORT THIS PROCESS" nocase ascii wide
      $msg03 = "DESTROY ALL OF YOUR DATA!" nocase ascii wide
      $msg04 = "PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED" nocase ascii wide
      $msg05 = "your important files are encrypted" ascii wide
      $msg06 = "Your personal installation key" nocase ascii wide
      $msg07 = "worth of Bitcoin to following address" nocase ascii wide
      $msg08 = "CHKDSK is repairing sector" nocase ascii wide
      $msg09 = "Repairing file system on " nocase ascii wide
      $msg10 = "Bitcoin wallet ID" nocase ascii wide
      $msg11 = "wowsmith123456@posteo.net" nocase ascii wide
      $msg12 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" nocase ascii wide
      $msg_pcre = /(en|de)crypt(ion|ed\.)/     

      // FUNCTIONALITY, APIS
      $functions01 = "need dictionary" nocase ascii wide
      $functions02 = "comspec" nocase ascii wide
      $functions03 = "OpenProcessToken" nocase ascii wide
      $functions04 = "CloseHandle" nocase ascii wide
      $functions05 = "EnterCriticalSection" nocase ascii wide
      $functions06 = "ExitProcess" nocase ascii wide
      $functions07 = "GetCurrentProcess" nocase ascii wide
      $functions08 = "GetProcAddress" nocase ascii wide
      $functions09 = "LeaveCriticalSection" nocase ascii wide
      $functions10 = "MultiByteToWideChar" nocase ascii wide
      $functions11 = "WideCharToMultiByte" nocase ascii wide
      $functions12 = "WriteFile" nocase ascii wide
      $functions13 = "CoTaskMemFree" nocase ascii wide
      $functions14 = "NamedPipe" nocase ascii wide
      $functions15 = "Sleep" nocase ascii wide // imported, not in strings     

      // COMMANDS
      //  -- Clearing event logs & USNJrnl
      $cmd01 = "wevtutil cl Setup" ascii wide nocase
      $cmd02 = "wevtutil cl System" ascii wide nocase
      $cmd03 = "wevtutil cl Security" ascii wide nocase
      $cmd04 = "wevtutil cl Application" ascii wide nocase
      $cmd05 = "fsutil usn deletejournal" ascii wide nocase
      // -- Scheduled task
      $cmd06 = "schtasks " nocase ascii wide
      $cmd07 = "/Create /SC " nocase ascii wide
      $cmd08 = " /TN " nocase ascii wide
      $cmd09 = "at %02d:%02d %ws" nocase ascii wide
      $cmd10 = "shutdown.exe /r /f" nocase ascii wide
      // -- Sysinternals/PsExec and WMIC
      $cmd11 = "-accepteula -s" nocase ascii wide
      $cmd12 = "wmic"
      $cmd13 = "/node:" nocase ascii wide
      $cmd14 = "process call create" nocase ascii wide

condition:
      // (uint16(0) == 0x5A4D)
      3 of ($dmap*)
      and 2 of ($msg*)
      and 9 of ($functions*)
      and 7 of ($cmd*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 49 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Probable PETYA ransomware detection rule, including suggested filters or exclusions:

Scheduled Patch Management Deployments via WSUS/SCCM
- Scenario: Enterprise patching tools (e.g., Microsoft SCCM, Ivanti, or WSUS) frequently utilize wmic and psexec.exe to push updates across the domain. During a scheduled maintenance window, these tools may trigger the ETERNALBLUE exploit signature on legacy Windows 7/Server 2016 systems while simultaneously executing remote commands via PsExec, mimicking the lateral movement behavior of PETYA.
- Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe (SCCM), wsusutil.exe, or specific patch management service accounts (e.g., DOMAIN\svc-patching). Additionally, filter out events occurring strictly within defined maintenance windows (e.g., Sundays 02:00–06:00 UTC).
IT Administration Remote Troubleshooting Sessions
- Scenario: Help Desk or System Administrators often use PsExec to remotely execute diagnostic scripts (powershell.exe, cmd.exe) on user workstations. If an admin connects to a machine that has not yet received the MS17-010 security update, the connection attempt combined with the execution of administrative commands can trigger the detection logic as a potential ransomware infection.
- Filter/Exclusion: Create an exclusion for source IP addresses belonging to the “IT Operations” VLAN or specific Admin Service Accounts (e.g., DOMAIN\svc-helpdesk, DOMAIN\admin-group). Ensure the filter checks that the command line arguments contain standard administrative flags (e.g., -c, -s) rather than suspicious encryption payloads.
Automated Backup and Imaging Solutions *