Splunk Enterprise Security

WannaCry [New variants] : How to detect the new variants of the ransomware?

Splunk Employee
Splunk Employee

I read the blog post that Splunk put out on Wannacry over the weekend which was really helpful to detect some of those earlier versions of the ransomware but in my understanding that this is evolving situation and there are many variants of the ransomware showing up in the wild.

Do you have any technical information useful to the Splunk community concerning Wannacry that you'd like to capture here?
What kind of searches are you using to find and detect these variants?
Any IOCs you care to share?

Blog which I am referring to: https://www.splunk.com/blog/2017/05/13/steering-clear-of-the-wannacry-or-wanna-decryptor-ransomware-...

Communicator

There're some sample queries you can test it out from the new app Splunk Essentials for Ransoware

https://splunkbase.splunk.com/app/3593/

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!