Interesting thread here, particularly if there's any remote powershell being used
If you are a firewall admin stop right now, apply these 2 rules. Block 137, 139, 445 inbound and outbound on your firewalls.
— EvilMog (@Evil_Mog) March 10, 2020
While you are at it on all your workstations block inbound on the same ports, also add in 5985 and 5986.
It will piss off admins but will stop worms!