Skip to content

Ransomware detection challenge

This capstone retains the original WannaCry proof of concept as a prominent investigation challenge. Its goal is not merely to execute a sample: it is to prove that Aurora detects the activity, applies the intended response, preserves useful evidence, and supports a defensible conclusion.

Specialist malware-handling controls required

Use only a disposable, isolated VM that you own and are authorised to test. Disconnect shared folders, clipboard integration, host networking, removable media, and production credentials. Create and verify a clean snapshot before introducing a sample. If any control is uncertain, use the safe interactive lab instead.

Readiness gate

Do not proceed until every item is true:

  • The Windows VM has a verified clean snapshot.
  • The virtual network cannot reach production systems or the internet.
  • Aurora is healthy and its rules load successfully.
  • The harmless Notepad response test has passed.
  • Required evidence locations and recovery steps are documented.
  • The operator understands the original malware-handling warning.

Investigation timeline

1. Establish the baseline

Record service status, profile, rule state, time, running processes, and the absence of ransomware artifacts.

2. Observe the original detonation sequence

The complete guide retains the original commands and handling context. Use its screenshots as the chronological evidence record:

Protected archive containing the WannaCry sample in the isolated VM

WannaCry sample prepared inside the controlled lab

WannaCry activity visible on the isolated Windows endpoint

3. Trace Aurora's response

Connect the process, rule match, response-set action, timestamp, and resulting process state. Avoid treating a single alert as the entire investigation.

Aurora response evidence for the WannaCry process

Final Aurora and endpoint state after the ransomware response

Open the complete original detonation and response procedure.

Challenge questions

  1. Which Aurora event first identifies the ransomware-related process?
  2. What fields connect the process to the configured Sigma rule?
  3. Which response action ran, and what evidence shows its outcome?
  4. What did Aurora prevent, and what does the available evidence not prove?
  5. Would the same rule be safe in blocking mode on a production endpoint?

Evidence and recovery

Preserve the alert details, relevant timestamps, rule and response configuration, process evidence, screenshots, observed effect, and limitations. Then power off the VM and revert to the verified pre-detonation snapshot; do not attempt to “clean” the working snapshot for reuse.

Challenge complete

You can reconstruct the detection and response timeline, state a bounded conclusion, and prove that the disposable VM was returned to its clean snapshot.

PreviousConfigure responsesNextHands-on labs