MS17-010 & EternalBlue: A Defensive Retrospective on the WannaCry Ransomware Outbreak

---
title: Potential WannaCry Infection - tasksche.exe Execution
id: 3a2f2b3c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects the execution of tasksche.exe, a specific process name used by the WannaCry ransomware to establish persistence and perform encryption.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2024/05/12
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\tasksche.exe'
    ParentImage|endswith:
      - '\services.exe'
      - '\svchost.exe'
  condition: selection
falsepositives:
  - Legitimate tasksche.exe (unlikely, as this is not a standard Windows binary)
level: critical
---
title: SMBv1 Driver or Service Installation
id: 8b4c3d2e-1f5a-6e7d-8c9b-0a1e2f3d4c5b
status: experimental
description: Detects attempts to enable the legacy SMBv1 protocol (mrxsmb10.sys), which is required for the EternalBlue exploit to function.
references:
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2024/05/12
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi'
      - 'sc.exe config mrxsmb10 start= auto'
      - 'dism /online /enable-feature /featurename:SMB1Protocol'
  condition: selection
falsepositives:
  - Legitimate legacy application requirements requiring administrative intervention
level: medium
---
title: WannaCry Kill Switch Domain Check
id: 9d5e4f3a-2b6c-7d8e-0f1a-2b3c4d5e6f7a
status: experimental
description: Detects DNS queries for the WannaCry kill switch domain (iuqerfsodp9ifwaposijfhgurjfihdf.com). This indicates a compromised host attempting to check if it should propagate.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2024/05/12
tags:
  - attack.command_and_control
  - attack.t1071.004
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'iuqerfsodp9ifwaposijfhgurjfdf.com'
      - 'ifferfsodp9ifwaposijfhgurjfdf.com'
  condition: selection
falsepositives:
  - Security research (unlikely in production)
level: high

// Hunt for WannaCry indicators: Process creation and Network Connections
// Process: Look for tasksche.exe execution
let ProcessHunt = DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "tasksche.exe"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256;
// Network: Look for Kill Switch domain or SMB traffic to non-standard internal subnets
let NetworkHunt = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has "iuqerfsodp9ifwaposijfhgurjfihdf" 
   or (RemotePort == 445 and ActionType == "ConnectionSuccess")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, LocalPort, ActionType;
// Combine results
union ProcessHunt, NetworkHunt
| order by Timestamp desc

-- Hunt for WannaCry artifacts on endpoints
-- 1. Check for the ransomware note in common directories
-- 2. Check for the malicious tasksche.exe binary
-- 3. Check registry for SMB1 status (Vulnerable if enabled)

LET RansomwareNotes = SELECT FullPath FROM glob(globs='\\*\\@WanaDecryptor@.exe')
WHERE FullPath =~ '(C:\\Users\\.|C:\\Windows\\|C:\\ProgramData\\)';

LET MaliciousBinary = SELECT FullPath FROM glob(globs='\\*\\tasksche.exe')
WHERE FullPath =~ '(C:\\Windows\\|C:\\ProgramData\\)';

SELECT 
  RansomwareNotes.FullPath AS RansomFile,
  MaliciousBinary.FullPath AS SuspectBinary,
  read_reg_key(path="HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters", key="SMB1") AS SMB1_Enabled
FROM scope()
GROUP BY RansomFile, SuspectBinary, SMB1_Enabled

# Remediation Script for WannaCry / MS17-010
# 1. Disables SMBv1 (the protocol required for EternalBlue)
# 2. Stops the specific WannaCry services if they exist

Write-Host "Starting MS17-010 / WannaCry Hardening Script..." -ForegroundColor Cyan

# Disable SMBv1 Protocol (Server)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Write-Host "[+] SMBv1 Server Configuration disabled." -ForegroundColor Green

# Disable SMBv1 Protocol (Client Workstation)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation" -Name "DependOnService" -Value @("Bowser","MRxSmb20","NSI")
Write-Host "[+] SMBv1 Client Configuration disabled." -ForegroundColor Green

# Stop and delete services created by WannaCry (tasksche.exe)
$svc = Get-Service -Name "mssmsq" -ErrorAction SilentlyContinue
if ($svc) {
    Stop-Service -Name "mssmsq" -Force
    sc.exe delete "mssmsq"
    Write-Host "[+] Removed WannaCry persistence service 'mssmsq'." -ForegroundColor Green
}

Write-Host "Remediation complete. Please verify MS17-010 is installed via Windows Update." -ForegroundColor Cyan