An investigation has identified suspicious DNS queries related to the WannaCry kill-switch mechanism. The queries originated from an internal host querying a known kill-switch domain, indicating potential infection or reconnaissance activity.