huntrule

Detect WannaCry killswitch domains in DNS queries

Flags DNS lookups for known WannaCry killswitch domain strings and variants.

FreeUnreviewedSigmahighv1
title: Detect WannaCry killswitch domains in DNS queries
id: 39cb9c1a-7c25-48c3-bb84-36ce6d77b2b4
status: test
description: This rule matches DNS queries for specific WannaCry killswitch domains, including .testing, .test, and .com variants. Attackers used these domains as an operational control mechanism during the campaign, so querying them can indicate related malicious activity. It relies on DNS telemetry containing the queried domain names.
references:
  - https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_wannacry_killswitch_domain.yml
author: Mike Wade, Huntrule Team
date: 2020-09-16
modified: 2022-03-24
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: dns
detection:
  selection:
    query:
      - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing
      - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test
      - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com
      - ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com
      - iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com
  condition: selection
falsepositives:
  - Analyst testing
level: high
license: DRL-1.1
related:
  - id: 3eaf6218-3bed-4d8a-8707-274096f12a18
    type: derived

What it detects

This rule matches DNS queries for specific WannaCry killswitch domains, including .testing, .test, and .com variants. Attackers used these domains as an operational control mechanism during the campaign, so querying them can indicate related malicious activity. It relies on DNS telemetry containing the queried domain names.

Known false positives

  • Analyst testing

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.