ThreatFox: WannaCryptor IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the presence of specific WannaCryptor indicators, such as known malicious hashes and network connections to command-and-control infrastructure. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage ransomware infections and initiate containment before encryption spreads across critical assets.

IOC Summary

Malware Family: WannaCryptor Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`cb245fa68d9f08372281be72241876a0`	payload	2026-08-04	95%
sha256_hash	`675cf32ce5553a1f2a9fa1b65014abc30df6a93f6ace616878dc534fc238c77a`	payload	2026-08-04	95%
sha1_hash	`ec0fba7419fe129f91fed01cae2d24fd3cbd480f`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - WannaCryptor
let malicious_hashes = dynamic(["cb245fa68d9f08372281be72241876a0", "675cf32ce5553a1f2a9fa1b65014abc30df6a93f6ace616878dc534fc238c77a", "ec0fba7419fe129f91fed01cae2d24fd3cbd480f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — WannaCryptor

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the ThreatFox: WannaCryptor IOCs detection rule:

Scenario: Scheduled Antivirus Full Scan on File Servers
- Context: Enterprise file servers (e.g., Windows Server 2019) running a nightly full scan using Microsoft Defender Antivirus or Symantec Endpoint Protection. The scanner frequently accesses the specific registry keys and network ports monitored by the rule during its deep inspection of user data folders.
- Filter/Exclusion: Create an exclusion for the process MsMpEng.exe (or Rtvscan64.exe) when running on hosts within the File-Server OU, specifically excluding traffic to port 445 and registry paths related to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule.
Scenario: Automated Backup Job Execution
- Context: A nightly backup job orchestrated by Veeam Backup & Replication or Rubrik connects to the domain controller to verify integrity. The backup agent generates network connections and file system modifications that mimic the WannaCryptor encryption behavior (specifically accessing .vhd and .log files).
- Filter/Exclusion: Exclude alerts where the source process is VeeamService.exe or RubrikAgent.exe, provided the destination IP belongs to the internal backup subnet (e.g., 10.20.30.0/24) and the file extension matches known backup formats like .vbk or .rbr.
Scenario: Patch Deployment via Configuration Management
- Context: The IT operations team deploys monthly security patches using Microsoft Endpoint Configuration Manager (MECM) or Ansible. During the deployment, the agent (ccmsetup.exe or ansible-runner) modifies system