""ET EXPLOIT Possible ETERNALCHAMPION MS17-010 Sync Response""

SID: 2024213

Revision: 3

Class Type: trojan-activity

Metadata: attack_target SMB_Server, created_at 2017_04_17, deployment Internal, signature_severity Critical, updated_at 2017_04_17

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: 445

Destination Network: any

Destination Port: any

Flow: from_server,established

Contents:

• Value: "|ff|SMB|25 00 00 00 00 98 03 c0 00 00 00 00 00 00 00 00 00 00 00 00|" Depth: 24 Offset: 4

• Value: "|7c 00|"

• Value: "|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"

• Value: "|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"

• Value: "|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"

• Value: "|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"

• Value: "|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"

Within: 20

PCRE:

Special Options:

source