WannaCry was a fast-spreading ransomware outbreak that disrupted organizations worldwide, including major impacts to the UK National Health Service (NHS). Microsoft and government advisories linked the outbreak to exploitation of SMB-related vulnerabilities addressed by Microsoft’s MS17-010 updates, and Microsoft referenced CVE-2017-0144 in its customer guidance. Government reporting described operational disruption and response costs for affected organizations.
First reported May 12, 2017Ransomwarehigh overall confidence
T1486: WannaCry encrypted files to disrupt operations and demand payment, consistent with ransomware encryption impact.
T1210: Public advisories describe SMB vulnerability exploitation enabling spread across systems via remote services.
Mitigations
Now
Apply MS17-010 security updates (and disable SMBv1 where possible)Prevents exploitation of the SMB vulnerabilities used for worm-like propagation.
Soon
Maintain offline/immutable backups and test restoresEnables recovery without paying ransom when systems are encrypted.
Later
Limit lateral movement by network segmentation and restricting SMB between segmentsReduces the ability of wormable malware to propagate rapidly across the enterprise.
Detection ideas
Detect rapid file encryption and ransom note creation on endpoints
Alert on high-rate file modifications/renames, creation of ransom note files, and unusual processes writing many files quickly.
Data sources: EDR telemetry, File integrity monitoring, Windows Security Event Logs
Detect SMB scanning/lateral movement spikes
Look for many SMB connection attempts to many internal hosts in a short period, especially from non-server endpoints.
Data sources: NetFlow/flow logs, IDS alerts, Firewall logs
