We know that an AV would be able to stop a WannaCry executable that can be found in an attack email/file just before double-clicking.
However would an anti-virus be able to block against a WannaCry infection coming through the smbv1 zero day vulnerability ?
Since the code is loaded to memory directly in the vulnerability payload without the medium of a double-clicked file, this question comes to mind.