""ET EXPLOIT Possible ECLIPSEDWING RPCTOUCH MS08-067""

SID: 2024214

Revision: 3

Class Type: trojan-activity

Metadata: attack_target SMB_Server, created_at 2017_04_17, deployment Internal, signature_severity Critical, updated_at 2022_05_03

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: 445

Flow: established,to_server

Contents:

  • Value: "|ff|SMB|2f 00 00 00 00|" Depth: 9 Offset: 4

  • Value: "NTLMSSP|00 03 00 00 00 01 00 01 00|"

  • Value: "|00 00 00 00 49 00 00 00|"

  • Value: "|00 00 00 00 48 00 00 00|"

  • Value: "|00 00 00 00 48 00 00 00|"

  • Value: "|00 00 00 00 48 00 00 00|"

  • Value: "|00 00 00 00 49 00 00 00|"

  • Value: "|00 00 00 00 00 00 00 00 00|"

Within: 9

PCRE:

Special Options:

  • fast_pattern

source