WannaCry Killswitch Domain DNS Query

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects DNS queries for specific domains associated with the WannaCry ransomware killswitch. The presence of these queries indicates a potential WannaCry infection attempting to resolve its killswitch domain. If the domain resolves, the ransomware may cease its encryption activities.