""ET EXPLOIT Possible ETERNALROMANCE MS17-010""

SID: 2024208

Revision: 2

Class Type: trojan-activity

Metadata: attack_target SMB_Server, created_at 2017_04_17, deployment Internal, signature_severity Critical, updated_at 2017_04_17

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: 445

Destination Network: any

Destination Port: any

Flow: from_server,established

Contents:

  • Value: "|FF|SMB|25 05 00 00 80|" Depth: 9 Offset: 4

  • Value: "LSbfLScnLSepLSlfLSmf"

  • Value: "LSrfLSsrLSscLSblLSss"

  • Value: "LSshLStrLStcLSopLScd"

Within: 20

PCRE:

Special Options:

  • fast_pattern

source