Scanning and Remediating WannaCry/MS17-010 in InsightVM and Nexpose

Today, security teams are starting their work week with a scramble to remediate MS17-010, in order to prevent the associated ransomware attack, WannaCry, also known as Wanna Decryptor, WNCRY, and Wanna Decryptor 2.0 (how I miss the halcyon days when vulnerabilities had gentle names like Poodle).

With all of the WannaCry information circulating we want to keep this simple. First, check out this link to an overview of the WannaCry ransomware vulnerability written by Bob Rudis, and then review the below steps to quickly scan for this vulnerability in your own infrastructure (if you aren't already a customer, go try out InsightVM for free you can use this free trial to scan for this vulnerability across your environment), create a dynamic asset group to continuously see affected assets, as well as create a dynamic remediation project to track the progress of remediating WannaCry.

Here is the InsightVM/Nexpose step-by-step guide to create a scan template specifically to look for MS17-010:

1. Under the Administration tab, go to Templates > Manage Templates

2. Copy the following template: Full Audit enhanced logging without Web Spider. Don't forget to give your copy a name and description; here, we'll call it "WNCRY Scan Template"

3. Click on Vulnerability Checks and then "By Individual Check"

4. Add Check "MS17-010" and click save:

This should come back with 192 checks that are related to MS17-010. The related CVEs are:

CVE-2017-0143

CVE-2017-0144

CVE-2017-0145

CVE-2017-0146

CVE-2017-0147

CVE-2017-0148

5. Now, under “By Category” click "Remove Categories", select all, and click save:

6. And finally, under Check Type, click "Remove Check Types", select all, and click save

7. Save the template and run a scan to identify all assets with MS17-010.

Creating a Dynamic Asset Group for MS17-010

Now that you have your assets scanned, you may want to create a Dynamic Asset Group to report/tag off of that will update itself whenever new assets are found with this vulnerability (and when they are fixed). To get started, click on the filter icon in the top right of the InsightVM console, just under the search button:

Now, use the “CVE ID” filter to specify the CVEs listed below:

This asset group can now be used for reporting as well as tagging to quickly identify exposed systems.

Creating a WannaCry Dashboard

Recently, Ken Mizota posted an article on how to build a custom dashboard to track your exposure to exploits from the Shadow Brokers leak. If you already did that, you’re good to go! If you wanted to be specific to WannaCry, you could use this Dashboard filter:

asset.vulnerability.title CONTAINS “cve-2017-0143” OR asset.vulnerability.title CONTAINS “cve-2017-0144” OR asset.vulnerability.title CONTAINS “cve-2017-0145” OR asset.vulnerability.title CONTAINS “cve-2017-0146” OR asset.vulnerability.title CONTAINS “cve-2017-0147” OR asset.vulnerability.title CONTAINS “cve-2017-0148”

Creating a Remediation Project for MS17-010:

In InsightVM, you can also create a remediation project for MS17-010 to track the progress of remediation live. To do this, go to the "Projects" tab and click "Create a Project":

Give the project a name, and under vulnerability filter type in "vulnerability.vulnKey = "MS17-010":

Note that this project is going to be dynamic, so it will automatically update as you fix and/or find new instances of this vulnerability.

Now, you can give this project a description, and configure who is responsible for remediation, as well as access levels if you wish. If you have JIRA, you can also configure the automatic ticketing integration between InsightVM and JIRA to automatically assign tickets to the right folks.

Using these steps, you'll be able to quickly scan for the WannaCry vulnerability as well as ensure that the vulns are being remediated. If you have any questions please don't hesitate to let us know!

For more information and resources on WannaCry and ransomware, please visit this page.