Detects Worm used during 2017-May-12th WannaCry campaign, which is based on ETERNALBLUE

Hunt Hypothesis

This hunt targets adversaries leveraging the EternalBlue vulnerability to propagate worm-like malware similar to the WannaCry campaign across unpatched endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because early detection of lateral movement via SMB exploits allows teams to isolate affected systems before widespread encryption and ransom demands occur.

YARA Rule

rule worm_ms17_010 : worm_ms17_010 {

meta:

description = "Detects Worm used during 2017-May-12th WannaCry campaign, which is based on ETERNALBLUE"

author = "Blueliv"

reference = "https://blueliv.com/research/wannacrypt-malware-analysis/"

date = "2017-05-15"

strings:

$s01 = "__TREEID__PLACEHOLDER__" ascii

$s02 = "__USERID__PLACEHOLDER__@" ascii

$s03 = "SMB3"

$s05 = "SMBu"

$s06 = "SMBs"

$s07 = "SMBr"

$s08 = "%s -m security" ascii

$s09 = "%d.%d.%d.%d"

$payloadwin2000_2195 =

"\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00"

$payload2000_50 =

"\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00\x2e\x00\x30\x00\x00\x00"

condition:

all of them

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 10 string patterns in its detection logic.

References

• https://blueliv.com/research/wannacrypt-malware-analysis/
• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the WannaCry / EternalBlue detection rule, including suggested filters and exclusions:

• Patch Management Deployment via WSUS or SCCM

  • Scenario: The Enterprise Patch Management system (e.g., Microsoft Endpoint Configuration Manager or WSUS) automatically pushes the MS17-010 security update to a large group of Windows 7/Server 2008 R2 machines. During this process, the patch installer triggers network scans and SMB port connectivity checks that mimic the initial probing behavior of the EternalBlue exploit.
  • Suggested Filter: Exclude traffic originating from known Patch Management servers (e.g., Source IP = <WSUS_Server_IP> or Process Name = "ccmexec.exe") targeting internal subnets during standard maintenance windows (e.g., 02:00–04:00 UTC).

• Scheduled Backup Jobs Utilizing SMB Protocol

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled jobs that mount virtual disks over the network using Server Message Block (SMB) to perform incremental backups. These tools often open multiple high-volume connections on ports 445 and 139, which can trigger the rule’s signature for worm propagation activity.
  • Suggested Filter: Create an exclusion for traffic where the Destination Port is 445/139 AND the Source Process matches known backup agents (e.g., “VeeamAgent.exe”, “cvbdagent.exe”) and the connection duration exceeds a threshold typical of one-time exploit attempts (e.g., > 60 seconds).

• Active Directory Group Policy Updates

  • Scenario: During scheduled Group Policy Object (GPO) refreshes, Domain Controllers push policy changes that involve file replication over SMB.