Windows process activity matching WannaCry executables and ransom note text

title: Windows process activity matching WannaCry executables and ransom note text
id: 89bac153-d09f-40e9-8686-8a52a471751e
status: test
description: This rule matches Windows process creation events where the process image name ends with known WannaCry-associated filenames or contains the substring 'WanaDecryptor'. It also requires the command line to include '@Please_Read_Me@.txt', a characteristic ransom note marker. The combination helps identify attempted ransomware execution and related components using process creation telemetry with image path and command-line fields.
references:
  - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
  - https://x.com/nas_bench/status/1868639048484425963
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml
author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro, Huntrule Team
date: 2019-01-16
modified: 2025-10-18
tags:
  - attack.lateral-movement
  - attack.defense-impairment
  - attack.t1210
  - attack.discovery
  - attack.t1083
  - attack.t1222.001
  - attack.impact
  - attack.t1486
  - attack.t1490
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \tasksche.exe
        - \mssecsvc.exe
        - \taskdl.exe
        - \taskhsvc.exe
        - \taskse.exe
        - \111.exe
        - \lhdfrgui.exe
        - \linuxnew.exe
        - \wannacry.exe
    - Image|contains: WanaDecryptor
  selection_cmd:
    CommandLine|contains: "@Please_Read_Me@.txt"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 41d40bff-377a-43e2-8e1b-2e543069e079
    type: derived