Ransomware

WannaCry

Ransomware Needs review 30 detections found

This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as ransomware-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: WCry, WanaCry, WanaCrypt, WanaCrypt0r, WannaCry

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0366) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

WannaCry, Software S0366 — MITRE ATT&CK

Detection rules

Source	Rule	Status	Updated
sigma	WannaCry Ransomware Activity	test	2025-10-18
suricata	ET MALWARE Possible WannaCry DNS Lookup 2	rev 7	2022-08-19
suricata	ET MALWARE Possible WannaCry DNS Lookup 1	rev 6	2022-08-19
suricata	ET MALWARE Possible WannaCry DNS Lookup 5	rev 7	2022-08-19
suricata	ET MALWARE Possible WannaCry DNS Lookup 3	rev 9	2022-08-19
suricata	ET MALWARE Possible WannaCry DNS Lookup 4	rev 7	2022-08-19
sigma	Wannacry Killswitch Domain	test	2022-03-24
suricata	ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 3	rev 6	2020-10-09
suricata	ET MALWARE W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	rev 5	2020-10-09
snort	ET TROJAN Possible WannaCry DNS Lookup 4	rev 4	2019-08-28
snort	ET TROJAN Possible WannaCry DNS Lookup 5	rev 4	2019-08-28
snort	ET TROJAN Possible WannaCry DNS Lookup 2	rev 4	2019-08-28
snort	ET TROJAN Possible WannaCry DNS Lookup 1	rev 4	2019-08-28
snort	ET TROJAN Possible WannaCry DNS Lookup 3	rev 6	2019-08-28
snort	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 3	rev 4	2017-05-19
snort	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	rev 3	2017-05-18
yara	WannCry_BAT	—	—
yara	WannaCry_RansomNote	—	—
yara	lazaruswannacry	—	—
yara	WannaCry_Ransomware_Dropper	—	—
yara	WannaCry_SMB_Exploit	—	—
yara	wannacry_static_ransom	—	—
yara	wannacry_memory_ransom	—	—
yara	worm_ms17_010	—	—
yara	MS17_010_WanaCry_worm	—	—
yara	NHS_Strain_Wanna	—	—
yara	Wanna_Cry_Ransomware_Generic	—	—
yara	WannaCry_Ransomware_Gen	—	—
yara	WannaCry_Ransomware	—	—
yara	WannCry_m_vbs	—	—