1

We know that an AV would be able to stop a WannaCry executable that can be found in an attack email/file just before double-clicking.

However would an anti-virus be able to block against a WannaCry infection coming through the smbv1 zero day vulnerability ?

Since the code is loaded to memory directly in the vulnerability payload without the medium of a double-clicked file, this question comes to mind.

  • "We know that an AV would be able to stop a WannaCry executable that can be found in an attack email/file just before double-clicking." - we know should say hope – ISMSDEV Jun 27 '17 at 23:20
3

Maybe. It should.

It all depends on the AV, its inner workings, etc. In addition to how the actual virus works (in this case WannaCry).

For instance, WannaCry has several files, which are unpacked then run. If your AV also detects those in addition to the container, it would be reasonable that it stopped the infection, too.

Additionally, if the machine is directly connected to the internet, it would probably connect to the public sinkhole, thus not doing the real infection.

By the way, just as you should be using an up to date antivirus, you should be up to date with Microsoft patches, which means the machine wouldn't be vulnerable to the smb vulnerability used by ETERNALBLUE.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.