STAGE 4: DETECT
Multi-Layered Threat Detection Matrix
Real-time correlation across static signatures, EDR behavioral telemetry, heuristic scoring bands (0-29 Low, 30-59 Med, 60-79 High, 80+ Crit), and AI/ML feature vectors.
100/ 100
CRITICAL RISKTARGET: WannaCry.exe (x86 (32-bit))• SHA256: 24d004a104d4d540...
Autonomous Consensus Verdict: CONFIRMED MALICIOUS PAYLOAD
High-impact self-propagating ransomware worm utilizing the MS17-010 (EternalBlue/DoublePulsar) exploit on SMB port 445. Features hardcoded killswitch domain check before executing multi-threaded AES-128 / RSA-2048 encryption across target file system.
Entropy: 7.98Family: RansomwareActive Capabilities: 6MITRE TTPs: 6
Active Layer Filters
1. Signature Layer
100%YARA rules: 1 matches
Hashes: MD5, SHA256, Imphash, SSDEEP
Hashes: MD5, SHA256, Imphash, SSDEEP
2. Behavioral EDR
100%Processes: 4 spawned
Injected Memory: 1 regions
Injected Memory: 1 regions
3. Heuristic Bands
100%Classification: CRITICAL
Entropy: 7.98 (Packed: YES)
Entropy: 7.98 (Packed: YES)
4. AI/ML Vectors
99%Ensemble: RF 99.4% / XGB 99.8%
Deep Learning: 98.9%
Deep Learning: 98.9%
Detailed Cross-Layer Telemetry Matrix
| Detection Layer | Observed Telemetry Signal | Confidence | Verdict |
|---|---|---|---|
| Cryptographic Signatures | SHA256 match & 4 PE sections parsed | 99.9% | MATCH |
| YARA Pattern Engine | Ransomware_Win32_WannaCry_Rule | 100% | HIT (1) |
| Dynamic Process Tree | 4 execution chains, injected: NO | 95.0% | ANOMALOUS |
| Network & C2 Cadence | 1 TCP streams, 1 HTTP beacons | 92.4% | C2 DETECTED |
| Heuristic Entropy & Packing | Entropy 7.98 / 8.0, Packed: True | 100% | CRITICAL |
| Random Forest Ensemble | 500 Decision Trees (Dominant: High .rsrc entropy + CryptEncrypt + vssadmin execution) | 99.4% | MALWARE |
| XGBoost Gradient Booster | Gradient Tree Boosting on 1,420 IAT/PE feature vectors | 99.8% | MALWARE |
| Deep Neural Network | Convolutional Byte-Sequence Network (1D-CNN + BiLSTM) | 98.9% | MALWARE |
Heuristic Scoring Thresholds (0 - 100)
Critical (80+)
Immediate Quarantine & SOAR IsolationHigh (60 - 79)
Deep Sandbox Detonation RequiredMedium (30 - 59)
Suspicious Heuristics (Unsigned / Packed)Low (0 - 29)
Standard Clean Binary Telemetry Dynamic Layer Weight Distribution
Signature Weight:25%
Behavioral EDR Weight:30%
Heuristic Bands Weight:20%
AI/ML Feature Vectors Weight:25%