From the SNORT folks...
http://blog.talosintelligence.com/2017/05/wannacry.html?m=1
".... Additionally, organizations should strongly consider blocking connections to TOR nodes and TOR traffic on network. Known TOR exit nodes are listed within the Security Intelligence feed of ASA Firepower devices. Enabling this to be blacklisted will prevent outbound communications to TOR networks."
<>< Jon L. Gardner Mobile: +1 979-574-1189 Email/Skype/Jabber: jon@brazoslink.net AIM/iChat/MSN: jlg@mac.com