Detection for worm-strain bundle of Wcry, DOublePulsar

Hunt Hypothesis

This detection identifies the simultaneous propagation patterns characteristic of the Wcry and DoublePulsar worm strains, which often exploit legacy SMB vulnerabilities to establish rapid lateral movement across networks. Proactively hunting for this specific bundle in Azure Sentinel is critical because these worms frequently serve as initial footholds for advanced persistent threats that escalate from low-severity indicators into high-impact ransomware campaigns if left unmitigated.

YARA Rule

rule NHS_Strain_Wanna: NHS_Strain_Wanna
{
        meta:
                description = "Detection for worm-strain bundle of Wcry, DOublePulsar"
                MD5 = "db349b97c37d22f5ea1d1841e3c89eb4"
                SHA1 = "e889544aff85ffaf8b0d0da705105dee7c97fe26"
                SHA256 = "24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c"
                INFO = "Looks for specific offsets of c.wnry and t.wnry strings"
 
        strings:
                $cwnry = { 63 2e 77 6e 72 79 }
                $twnry = { 74 2e 77 6e 72 79 }
 
        condition:
                $cwnry at 262324 and $twnry at 267672 and $cwnry at 284970
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Wcry/DoublePulsar detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Antivirus Full Scans on File Servers

  • Scenario: Enterprise file servers (e.g., Windows Server 2019) running a scheduled full scan using tools like Microsoft Defender for Endpoint or Symantec Endpoint Protection. These scans often trigger high-volume SMB traffic and generate specific registry modifications that mimic the lateral movement signatures of Wcry.
  • Filter/Exclusion: Create an exclusion rule to suppress alerts originating from the specific service accounts used by the AV software (e.g., NT AUTHORITY\SYSTEM or a dedicated svc_antivirus account) during their defined maintenance windows (e.g., 02:00–04:00 UTC).

• Patch Management Deployment via WSUS/SCCM

  • Scenario: Automated patching cycles using Microsoft Endpoint Configuration Manager (MECM/SCCM) or WSUS. During the deployment of cumulative updates, these tools utilize SMB and RPC protocols to push packages to endpoints, generating network traffic patterns that closely resemble the DoublePulsar worm’s exploitation of MS17-010.
  • Filter/Exclusion: Exclude traffic where the source IP belongs to the Patch Management infrastructure subnet (e.g., 10.20.50.0/24) and the destination port matches standard patching ports (TCP 8530, 443) during known deployment windows.

• Backup Agent Synchronization Jobs

  • Scenario: Backup agents such as Veeam Backup & Replication, Commvault, or Rubrik performing incremental synchronization of virtual machines. These jobs often involve heavy file replication over SMB/CIFS