Worm exploiting MS17-010 and dropping WannaCry Ransomware

Hunt Hypothesis

This hunt targets adversaries leveraging the EternalBlue vulnerability (MS17-010) to propagate laterally across unpatched Windows systems while simultaneously deploying WannaCry ransomware payloads. Proactively hunting for this behavior in Azure Sentinel is critical because even low-severity alerts can indicate an active, self-replicating worm capable of rapid network-wide encryption before traditional endpoint defenses trigger high-priority alarms.

YARA Rule

rule MS17_010_WanaCry_worm {
	meta:
		description = "Worm exploiting MS17-010 and dropping WannaCry Ransomware"
		author = "Felipe Molina (@felmoltor)"
		reference = "https://www.exploit-db.com/exploits/41987/"
		date = "2017/05/12"
	strings:
		$ms17010_str1="PC NETWORK PROGRAM 1.0"
		$ms17010_str2="LANMAN1.0"
		$ms17010_str3="Windows for Workgroups 3.1a"
		$ms17010_str4="__TREEID__PLACEHOLDER__"
		$ms17010_str5="__USERID__PLACEHOLDER__"
		$wannacry_payload_substr1 = "h6agLCqPqVyXi2VSQ8O6Yb9ijBX54j"
		$wannacry_payload_substr2 = "h54WfF9cGigWFEx92bzmOd0UOaZlM"
		$wannacry_payload_substr3 = "tpGFEoLOU6+5I78Toh/nHs/RAP"

	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• https://www.exploit-db.com/exploits/41987/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Worm exploiting MS17-010 and dropping WannaCry Ransomware detection rule, tailored for an enterprise environment:

• Scheduled Endpoint Protection Scans on Patched Servers

  • Scenario: Enterprise-grade EDR agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) perform scheduled deep scans of the C:\Windows\System32 directory. During these scans, the agent may simulate file creation and network socket binding activities that mimic the initial propagation behavior of the MS17-010 worm (specifically SMB port 445 traffic) without actually executing malicious payloads.
  • Suggested Filter: Exclude traffic originating from known EDR service accounts (e.g., NT SERVICE\DefenderSvc or specific CrowdStrike hostnames) where the destination IP is an internal management server, and the process hash matches a verified “Good” signature in the threat intelligence feed.

• Automated Patch Management Deployment via WSUS/SCCM

  • Scenario: During monthly maintenance windows, Microsoft Endpoint Configuration Manager (MECM/SCCM) or WSUS pushes cumulative updates to legacy Windows Server 2016/2019 instances. The deployment process involves the wuauserv service establishing SMB connections to distribute update packages and temporarily creating files in the %TEMP% directory, which can trigger the “dropping ransomware” logic if the file metadata resembles a dropped executable.
  • Suggested Filter: Create an exclusion for network flows where the source process is ccmexec.exe or wuauclt.exe and the destination port is 445 (SMB), provided the event timestamp falls within the defined maintenance window (e.g., Sundays between 02:00–0