How to verify WannaCry

Content Authoring
1

I want to verify WannaCry using bigfix.
I know that the way was shown on the link. But this URL isn’t enough to me.
Because this way can’t use to Win10 1703 and later version.
So please tell me how to add the check script about Win10 1703 and later version.

https://www.bigfix.me/analysis/details/2998568

I added the following script ,but bigfix wasn’t working.

-add content
((name of it = “Win10” AND build number of it as string = “16299”) of operating system) OR ((name of it = “Win10” AND build number of it as string = “17134”) of operating system)

-Properties
(( ( ((name of it = “Win10” OR Name of it = “Win2016” AND build number of it as string = “14393”) of operating system) AND it >= “10.0.14393.953” ) OR ( ((name of it = “Win10” AND build number of it as string = “10586”) of operating system) AND it >= “10.0.10586.839”) OR ( ((name of it = “Win10” AND build number of it as string = “10240”) of operating system) AND it >= “10.0.10240.17319”) OR ( ((name of it = “WinVista” OR name of it = “Win2008” ) of operating system) AND (it >= “6.0.6002.19743” OR it >= “6.0.6002.24067”) ) OR ( ((name of it = “Win7” OR name of it = “Win2008R2”) of operating system) AND it >= “6.1.7601.23689”) OR ( ((name of it = “Win8” OR name of it = “Win2012” ) of operating system) AND (it >= “6.2.9200.22099”)) OR ( ((name of it = “Win8.1” OR name of it = “Win2012R2” ) of operating system) AND (it >= “6.3.9600.18604”)) OR ( ((name of it = “Win2003”) of operating system) AND (it >= “5.2.3790.6021”)) OR ( ((name of it = “WinXP”) of operating system) AND (it >= “5.1.2600.7208”)) ) of versions of files “srv.sys” of folders “drivers” of native system folders) OR (((name of it = “Win10” AND build number of it as string = “16299”) of operating system) OR ((name of it = “Win10” AND build number of it as string = “17134”) of operating system))

Thank you,

2

For each OS & build you need to know the minimum acceptable file version you will accept.

In your script you are only checking OS & build - you aren’t checking the file version.

1 Like
3

Thank you for your reply.

win10 1703 and 1709 have already fixed about this.
So I think that bigfix doesn’t need to check the file version.
And I found that win10 1709 doesn’t have the file. So bigfix can’t check the file version.