How can security teams detect WannaCry?

What to look for when WannaCry starts spreading

Detection starts with the behaviour, not the filename. WannaCry is a wormable ransomware outbreak, so security teams should correlate sudden SMB propagation, repeated access attempts across internal hosts, mass encryption activity, and a burst of Windows systems talking to one another in patterns that do not match normal user workflow. The earliest signal is often lateral movement at scale, followed by shared resource abuse and process activity that appears on many endpoints in a short window.

That spread pattern matters because a single infected host can create a noisy but very recognisable trail. A useful hunt approach is to look for one endpoint initiating SMB connections to many peers, then check whether those peers begin opening, renaming, or rewriting large numbers of files shortly after. If your telemetry shows failed patching or lingering SMB exposure, the likelihood of a worm-style event rises quickly.

Endpoint and network indicators that matter most

Endpoint telemetry should prioritise process trees, file-system events, and unusual service or script activity that coincides with encryption. On the network side, watch for internal SMB scans, unusual port 445 traffic, and host-to-host communication that expands rapidly rather than remaining local to a user segment. The most reliable clue is often the combination, one infected host alone is less informative than many hosts showing similar behaviour at once.

File activity is especially important because ransomware frequently reveals itself through bulk renaming, extension changes, and sudden growth in file-write operations. Security teams should also look for access to shared folders and administrative resources that were not part of normal workstation behaviour. If the same pattern appears on multiple systems, treat it as an outbreak until proven otherwise.

For broader malware triage and pattern matching, Malware Guide is the most direct internal reference, while Ransomware Groups Guide helps teams distinguish worm-like ransomware activity from the operator tradecraft used by major ransomware ecosystems.

How to confirm it is really WannaCry, not just generic ransomware

The practical test is whether the incident shows worm behaviour plus encryption behaviour. Generic ransomware may stay localized to one user or one subnet, but WannaCry-style activity is notable for rapid internal spread through Windows hosts and the signature combination of SMB exposure, failed patching, and simultaneous compromise across multiple endpoints. That combination is what makes it operationally distinct.

Teams should compare infected hosts against patch status, SMB exposure, and recent east-west traffic. If multiple systems are suddenly encrypting files and also attempting to reach many internal peers, the event should be treated as a propagation problem, not just an endpoint infection. That changes the response priority from single-host containment to network-wide isolation and exposure reduction.

Authoritative threat-detection mapping is useful here, so MITRE ATT&CK Enterprise Matrix is a strong external reference for lateral movement and credential-access style investigation, and SANS Security Resources supports SOC-style detection engineering and incident handling workflows for this kind of outbreak.

Practitioner Guidance

What to prioritise: Start with hosts that show both SMB propagation and file encryption, then pivot to anything communicating with them over internal file-sharing paths. That ordering matters because an outbreak can expand faster than manual case-by-case triage.

What to verify: Confirm whether the environment still exposes vulnerable SMB paths, whether patching coverage is incomplete, and whether affected machines share the same administrative or backup access patterns. If the same network segment is lighting up, assume spread until segmentation proves otherwise.

Decision rule: If you see encryption on more than one host plus repeated internal SMB connections, move immediately to containment and fleet-wide exposure review rather than waiting for perfect malware confirmation. The cost of a false positive is lower than the cost of delayed isolation in a worm event.

Practitioner takeaway: The best WannaCry detection logic is correlation, not a single indicator, because the attack becomes obvious when worm-like spread, SMB reachability, and bulk encryption appear together.

Related resources from NHI Mgmt Group

• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?
• Why is the abuse of NHIs a priority for security teams?
• What is the difference between SAST and DAST for security teams?