Wannacry

[MichaelPochan]

Is it too early to start asking about Wannacry IOCs being incorporated into RSA Live content for Netwitness?

[BobDredger · Accepted solution]

Hey Mike,

    Absolutely not to early! Obviously very relevant right now. I can tell you we're is working on that now. In the mean time, I'd suggest keeping an eye out for any network traffic headed outbound to TOR nodes on ports >9000. Are you running packets logs or both?

Thanks,

Bob

[MichaelPochan]

Thank you for the reply! We're just running packets here. Have already deployed the 6 or so ET Pro Snort rules and have correlation rules looking for SMB scanning, but was just curious what other IOCs were being aggregated. 

[DeepakSolanki]

Is there any use cases are there which can detect the WannaCry Ransomware or Latest feeds are updated on RSA live which can help us to detect the Ransomware from Events.

[IshtiyaqShah]

As per my research till now, i could find below information which could help in at least detection of any variants, which should be enough for you to isolate the machine quickly on your network and then perform investigations:

> Check for traffic on port 445 minutely within your core network

> Monitor and validate any Network traffic headed outbound to TOR nodes on ports >9000

> Watch and block any permitted CnC traffic attempts ASAP on your all firewalls 

> Watch and block all kinds of download activity containing .Wncry extension like files 

> Also, look for below extensions for exe's within your files/registry scans on windows machines

WNCry, WCry, WanaCrypt0r, Wana Decrypt0r

> Any access to https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip

> Create a separate Alert Watchlist on SIEM/other monitoring solutions  for below C2 domains

gx7ekbenv2riucmf.onion, 

57g7spgrzlojinas.onion,

xxlvbrloxvriy2c5.onion, 

76jdd2ir2embyv47.onion, and 

cwwnhwhlz52maqm7.onion

> Check any outgoing communication attempt on below url from your organization;

iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

> Disable Autorun on all windows macihnes

> Do no disable UAC

> Monitor your SIEM or Log monitoring solutions for any Privilege changes/modifications

> Look for  Microsoft Security Bulletin MS17-010 and apply patches immediately if you have not till now. The ransomware exe file executes and exploits this Vulnerability and spreads like a worm within your network.

Note: This is not the complete list of indicators, however if you monitor these in addition to other solutions, your chances of being safe are high.

[Anonymous]

Although this is not directly targeting Wannacry I find that it is very useful.  We did see one Wannacry get launched and this is where I found the data from it.  

analysis.service = 'hostname consecutive consonants'&& risk.suspicious ='tunneling outbound tor'

Assuming you do not allow anything over the ports using a hostname with consecutive consonants you should get pretty good data.  If anything it is something you should be running daily to see if you have any connections like that to odd hostnames.