Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Wannacry Killswitch Domain

Detects wannacry killswitch domain dns queries

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Mike WadeCreated Wed Sep 16Updated Thu Mar 243eaf6218-3bed-4d8a-8707-274096f12a18network
Log Source
dns
Categorydns← raw: dns
Detection Logic
Detection Logic1 selector
detection:
    selection:
        query:
            - 'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing'
            - 'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test'
            - 'ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com'
            - 'ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com'
            - 'iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com'
    condition: selection
False Positives

Analyst testing

References
1
Resolving title…
mandiant.com
MITRE ATT&CK
Rule Metadata
Rule ID
3eaf6218-3bed-4d8a-8707-274096f12a18
Status
test
Level
high
Type
Detection
Created
Wed Sep 16
Modified
Thu Mar 24
Author
Mike Wade
Path
rules/network/dns/net_dns_wannacry_killswitch_domain.yml
Raw Tags
attack.command-and-controlattack.t1071.001
View on GitHub