WannaCry Ransomware Dropper

Hunt Hypothesis

This detection rule identifies the initial execution of a WannaCry dropper payload, signaling an adversary’s attempt to establish persistence and prepare for rapid lateral movement via SMB vulnerabilities. Proactively hunting for this behavior in Azure Sentinel is critical because early identification of the dropper allows the SOC team to isolate affected endpoints before the ransomware encrypts data and propagates across the network.

YARA Rule

rule WannaCry_Ransomware_Dropper
 {
 meta:
	description = "WannaCry Ransomware Dropper"
 	reference = "https://www.cylance.com/en_us/blog/threat-spotlight-inside-the-wannacry-attack.html"
 	date = "2017-05-12"

strings:
	$s1 = "cmd.exe /c \"%s\"" fullword ascii
 	$s2 = "tasksche.exe" fullword ascii
 	$s3 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
 	$s4 = "Global\\MsWinZonesCacheCounterMutexA" fullword ascii
 
 condition:
 	uint16(0) == 0x5a4d and filesize < 4MB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://www.cylance.com/en_us/blog/threat-spotlight-inside-the-wannacry-attack.html
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the WannaCry Ransomware Dropper rule in an enterprise environment, along with suggested filters or exclusions:

• Windows Server Update Services (WSUS) Deployment

  • Scenario: The WSUS server automatically pushes critical security updates to endpoints. During this process, the wuauserv service downloads and extracts update packages (often containing executable payloads similar to ransomware droppers) into temporary directories before installation. This activity frequently mimics the file creation and execution patterns of a WannaCry dropper.
  • Filter/Exclusion: Exclude processes where the parent process is wuauclt.exe or usocoreworker.exe running under the SYSTEM account, specifically when the target path contains \Windows\SoftwareDistribution\Download.

• Microsoft Defender Antivirus Real-Time Scanning

  • Scenario: Microsoft Defender performs real-time scanning and heuristic analysis on newly downloaded files. When a user downloads a large installer or archive, Defender may spawn a temporary worker process (e.g., MsMpEng.exe spawning MpCmdRun.exe) to unpack the file for inspection. This extraction behavior can trigger the dropper logic if the rule focuses heavily on rapid file creation and execution within user temp folders.
  • Filter/Exclusion: Create an exclusion for processes with a digital signature from “Microsoft Corporation” where the command line arguments include -Scan or -Extract, specifically targeting paths under %TEMP% or %LOCALAPPDATA%\Temp.

• Enterprise Patch Management Tool (e.g., SCCM/MECM) Application Deployment

  • Scenario: System Center Configuration Manager (SCCM) agents (ccmexec.exe) frequently deploy line-of-business applications. These deployments often involve a sequence of actions: downloading an .msi or .exe, extracting it to