Windows process activity matching WannaCry executables and ransom note text
Alerts on Windows process creation where WannaCry-related executables and the @Please_Read_Me@.txt command indicator appear.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule matches Windows process creation events where the process image name ends with known WannaCry-associated filenames or contains the substring 'WanaDecryptor'. It also requires the command line to include '@Please_Read_Me@.txt', a characteristic ransom note marker. The combination helps identify attempted ransomware execution and related components using process creation telemetry with image path and command-line fields.
Reporting behind it
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
- x.comhttps://x.com/nas_bench/status/1868639048484425963
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows process activity matching WannaCry executables and ransom note text
id: 89bac153-d09f-40e9-8686-8a52a471751e
status: test
description: This rule matches Windows process creation events where the process image name ends with known WannaCry-associated filenames or contains the substring 'WanaDecryptor'. It also requires the command line to include '@Please_Read_Me@.txt', a characteristic ransom note marker. The combination helps identify attempted ransomware execution and related components using process creation telemetry with image path and command-line fields.
references:
- https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
- https://x.com/nas_bench/status/1868639048484425963
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml
author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro, Huntrule Team
date: 2019-01-16
modified: 2025-10-18
tags:
- attack.lateral-movement
- attack.defense-impairment
- attack.t1210
- attack.discovery
- attack.t1083
- attack.t1222.001
- attack.impact
- attack.t1486
- attack.t1490
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \tasksche.exe
- \mssecsvc.exe
- \taskdl.exe
- \taskhsvc.exe
- \taskse.exe
- \111.exe
- \lhdfrgui.exe
- \linuxnew.exe
- \wannacry.exe
- Image|contains: WanaDecryptor
selection_cmd:
CommandLine|contains: "@Please_Read_Me@.txt"
condition: 1 of selection_*
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 41d40bff-377a-43e2-8e1b-2e543069e079
type: derived