WannaCry Ransomware Activity

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": [
        "\\tasksche.exe",
        "\\mssecsvc.exe",
        "\\taskdl.exe",
        "\\taskhsvc.exe",
        "\\taskse.exe",
        "\\111.exe",
        "\\lhdfrgui.exe",
        "\\linuxnew.exe",
        "\\wannacry.exe"
      ]
    },
    {
      "NewProcessName
| contains": "WanaDecryptor"
    }
  ],
  "selection_cmd": {
    "CommandLine
| contains": "@Please_Read_Me@.txt"
  },
  "condition": "process_creation and (1 of selection_*)"
}

False Positives

• ⚠ Unknown