WannaCry Ransomware Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 18, 2025•0•25

This rule detects activity associated with the WannaCry ransomware. It specifically looks for the creation of processes with image names commonly used by WannaCry variants (e.g., 'tasksche.exe', 'mssecsvc.exe', 'WanaDecryptor' in the image path) or command lines containing the WannaCry ransom note filename ('@Please_Read_Me@.txt').