This detection rule identifies adversary activity associated with the WannaCryptor ransomware by monitoring for its specific Indicators of Compromise (IOCs) within network traffic and endpoint logs. A proactive hunt in Azure Sentinel is critical to rapidly isolate infected assets before the malware can encrypt files across the organization, thereby minimizing operational downtime and data loss.
Malware Family: WannaCryptor Total IOCs: 9 IOC Types: sha256_hash, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | af49d090af04cd0acba34c3308c45d23 | payload | 2026-08-07 | 95% |
| sha256_hash | 295ea6d0c0e8948edec19dea2b6778d9b21cd52c2f1c29efe30462801f4efbac | payload | 2026-08-07 | 95% |
| sha1_hash | 44bb52939808600f5b230801404afa5e8a90ef64 | payload | 2026-08-07 | 95% |
| md5_hash | 6506c1b800a28853ef8af5a466e12e8d | payload | 2026-08-07 | 95% |
| sha256_hash | 66b98067cb4b20d0da1e9459f5851b7d86e046afa9a78ff87b9bb1c641e3a771 | payload | 2026-08-07 | 95% |
| sha1_hash | 617210d8feb0679a0f675269300fc19b4c49e66c | payload | 2026-08-07 | 95% |
| sha256_hash | 8cce14a06ff19f92020cefcf42c0040495c0dca18543f8449159ba1e78f69f29 | payload | 2026-08-07 | 95% |
| sha1_hash | 97454d2f3186331f68be1815e277488d891bbe16 | payload | 2026-08-07 | 95% |
| md5_hash | c763e05c8ed4b4cad85c610abdefc5f1 | payload | 2026-08-07 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - WannaCryptor
let malicious_hashes = dynamic(["af49d090af04cd0acba34c3308c45d23", "295ea6d0c0e8948edec19dea2b6778d9b21cd52c2f1c29efe30462801f4efbac", "44bb52939808600f5b230801404afa5e8a90ef64", "6506c1b800a28853ef8af5a466e12e8d", "66b98067cb4b20d0da1e9459f5851b7d86e046afa9a78ff87b9bb1c641e3a771", "617210d8feb0679a0f675269300fc19b4c49e66c", "8cce14a06ff19f92020cefcf42c0040495c0dca18543f8449159ba1e78f69f29", "97454d2f3186331f68be1815e277488d891bbe16", "c763e05c8ed4b4cad85c610abdefc5f1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: WannaCryptor IOCs detection rule, tailored for a legitimate enterprise environment:
Antivirus Definition Updates via Windows Update
MsMpEng.exe) or third-party agents like CrowdStrike (via C:\Program Files\CrowdStrike\csagent.exe) automatically download and install new definition updates. These processes often spawn child processes that match the WannaCryptor file hash or network signature, particularly when updating the “Wanna” malware protection module itself.C:\Program Files\Windows Defender\ or C:\Program Files\CrowdStrike\ from triggering this rule if the parent process is a known update service (e.g., usoc_dcom.exe).Scheduled Backup Jobs Using Veeam or Commvault
Veeam.Backup.Service.exe) or Commvault (simengine.exe) perform nightly encryption and compression of data volumes. During the encryption phase, these tools generate temporary files with hashes that overlap with WannaCryptor’s known IOCs, especially when processing large datasets on shared storage.Veeam.Backup.Service.exe, simengine.exe, and their child processes (vssvc.exe) running during defined maintenance windows (e.g., 01:00–05:00 local time).Patch Management Deployment via SCCM or Intune
ccmsetup.exe or Microsoft Endpoint Manager (Intune) agents (IntuneManagementExtension.exe) deploy security patches. When these tools execute the “W