Wannacry Killswitch Domain

Title: Wannacry Killswitch Domain
Status: test
Description:Detects wannacry killswitch domain dns queries
References:
  -https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign
Author: Mike Wade
Date: 2020-09-16
modified:2022-03-24
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: dns

Detection:
  selection:
    query:
      -'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing'
      -'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test'
      -'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com'
      -'ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com'
      -'iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com'

  condition:selection
Falsepositives:
  -Analyst testing
Level: high