Detects WannaCry Ransomware Note

Hunt Hypothesis

This hypothesis posits that adversaries are deploying WannaCry ransomware variants to encrypt critical assets and display recovery notes within the Azure environment. Proactive hunting for these specific artifacts in Azure Sentinel is essential to identify early-stage infections before they escalate into widespread data loss incidents, even when initial alerts carry a low severity rating.

YARA Rule

rule WannaCry_RansomNote {
   meta:
      description = "Detects WannaCry Ransomware Note"
      author = "Florian Roth"
      reference = "https://goo.gl/HG2j5T"
      date = "2017-05-12"
      hash1 = "4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e"
   strings:
      $s1 = "A:  Don't worry about decryption." fullword ascii
      $s2 = "Q:  What's wrong with my files?" fullword ascii
   condition:
      ( uint16(0) == 0x3a51 and filesize < 2KB and all of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://goo.gl/HG2j5T
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects WannaCry Ransomware Note rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Patch Deployment via WSUS/SCCM

  • Scenario: During a maintenance window, the System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS) pushes a critical security update that includes a reboot notification. The deployment script writes a standard informational message to the C:\Windows\Temp directory containing keywords like “Ransomware,” “Update,” and “Action Required” to alert users before the restart, mimicking the text structure of the WannaCry note file (README.txt).
  • Filter/Exclusion: Exclude events where the source process is ccmexec.exe, wsusclient.exe, or msiexec.exe running under the SYSTEM or a known Service Account (e.g., DOMAIN\svc_patch_deploy) and the file creation path matches the standard deployment temp directory.

• IT Helpdesk Automated Ticketing Scripts

  • Scenario: An IT automation script (written in PowerShell using tools like Ansible or Puppet) runs nightly to generate compliance reports. As part of a “System Health Check,” the script generates a README.txt file on user desktops containing a standard disclaimer message about data protection and backup status, which includes the phrase “Your files have been encrypted” as a placeholder text for future scenarios.
  • Filter/Exclusion: Filter out events where the parent process is powershell.exe or puppet-agent.exe, initiated by a scheduled task (e.g., TaskName: Daily_Compliance_Report) and the file content hash matches a known, static template rather than a dynamic, variable-length ransom note.

• Third-Party Backup Software Notifications

  • Scenario: Enterprise backup solutions