huntrule

Detect Wannacry killswitch DNS queries to hardcoded domains

Flags DNS lookups for known WannaCry killswitch domain strings and variants.

FreeReviewedSigma · High · v2
Category
dns
Author
Mike Wade (SigmaHQ), DRL 1.1
Published
2020-09-16
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags DNS queries for specific hardcoded domain names associated with the Wannacry killswitch. Attackers may use such domains to control ransomware behavior based on external DNS resolution. Detection relies on DNS query telemetry that includes the queried domain name.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange
Possible PlugX and NPS Proxy Command and Control Domain Lookup
Possible Backdoor Mistic Command and Control Domain Lookup
Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)
Malicious BlueNoroff C2 Communication via cur1-agent User-Agent (via proxy)
Possible GammaSteel C2 Using Spoofed iPhone User Agent
Suspicious PolarEdge Backdoor C2 URL with Module and putdata Command (via proxy)
Suspicious Interlock Backdoor C2 Beacon to init1234 Endpoint (via proxy)
Possible FakeBat Loader Payload Download and C2 URI Patterns
Suspicious HATVIBE C2 Beacon via HTTP PUT to PHP Endpoints (via proxy)
Detect Wannacry killswitch DNS queries to hardcoded domains
Pivot detection · T1071.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.