Detects WannaCry Ransomware VBS

Hunt Hypothesis

This detection rule identifies the execution of specific Visual Basic Script (VBS) files associated with the initial propagation and payload delivery stages of the WannaCry ransomware campaign. Proactively hunting for these artifacts in Azure Sentinel is critical because early identification of this legacy threat vector allows security teams to validate endpoint hardening measures and prevent lateral movement before encryption begins, even when automated alerts are classified as low severity.

YARA Rule

rule WannCry_m_vbs {
   meta:
      description = "Detects WannaCry Ransomware VBS"
      author = "Florian Roth"
      reference = "https://goo.gl/HG2j5T"
      date = "2017-05-12"
      hash1 = "51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b"
   strings:
      $x1 = ".TargetPath = \"C:\\@" ascii
      $x2 = ".CreateShortcut(\"C:\\@" ascii
      $s3 = " = WScript.CreateObject(\"WScript.Shell\")" ascii
   condition:
      ( uint16(0) == 0x4553 and filesize < 1KB and all of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://goo.gl/HG2j5T
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects WannaCry Ransomware VBS rule in an enterprise environment:

• Scheduled Antivirus Definition Updates via Group Policy

  • Scenario: Enterprise endpoints (e.g., Microsoft Defender for Endpoint or Symantec) automatically download and install virus definition updates. These updates often include .vbs scripts that execute to verify the integrity of new engine components, mimicking the initial execution behavior of the WannaCry payload.
  • Filter/Exclusion: Exclude processes where the parent process is MpCmdRun.exe, Symantec Antivirus Scanner (SAVSVC), or gpupdate.exe and the file path resides in standard vendor directories (e.g., C:\ProgramData\Microsoft\Windows Defender).

• IT Admin Deployment of PowerShell-to-VBS Migration Scripts

  • Scenario: System administrators frequently deploy legacy migration scripts written in VBScript to manage user profiles or configure local policies across the domain. When these admins run a script like UserConfig.vbs from a shared network drive (e.g., \\fileserver\scripts) using cscript.exe, it triggers the detection logic designed for standalone VBS execution.
  • Filter/Exclusion: Whitelist .vbs files executed by cscript.exe or wscript.exe where the file hash matches known internal scripts and the path is located within a designated “Trusted Scripts” network share (e.g., \\corp-srv\it-tools\scripts).

• Automated Patch Management via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager runs scheduled maintenance tasks. These tasks often utilize VBScript wrappers to check disk space, verify service status, and trigger the actual patch installation (wsusutil), creating a