Splunk Enterprise Security

WannaCry [New variants] : How to detect the new variants of the ransomware?

bpatel_splunk
Splunk Employee
Splunk Employee

I read the blog post that Splunk put out on Wannacry over the weekend which was really helpful to detect some of those earlier versions of the ransomware but in my understanding that this is evolving situation and there are many variants of the ransomware showing up in the wild.

Do you have any technical information useful to the Splunk community concerning Wannacry that you'd like to capture here?
What kind of searches are you using to find and detect these variants?
Any IOCs you care to share?

Blog which I am referring to: https://www.splunk.com/blog/2017/05/13/steering-clear-of-the-wannacry-or-wanna-decryptor-ransomware-...

muralianup
Communicator

There're some sample queries you can test it out from the new app Splunk Essentials for Ransoware

https://splunkbase.splunk.com/app/3593/

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>