ET EXPLOIT Possible Successful ETERNALROMANCE MS17-010 - Windows Executable Observed

7.0.35.0SID: 2024207Rev: 4Enabled0 views
Sourceet/open
Fileemerging-exploit.rules
CreatedApril 17, 2017
UpdatedMarch 7, 2024
Classificationtrojan-activity
alert smb any any -> $HOME_NET any (msg:"ET EXPLOIT Possible Successful ETERNALROMANCE MS17-010 - Windows Executable Observed"; flow:established,to_server; flowbits:isset,ETPRO.ETERNALROMANCE; content:"|FF|SMB|26 00 00 00 00|"; offset:4; depth:9; content:"|4d 5a|"; distance:0; content:"This program cannot be run"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2024207; rev:4; metadata:attack_target SMB_Server, created_at 2017_04_17, deployment Internal, confidence Medium, signature_severity Critical, updated_at 2024_03_07;)

Metadata

attack targetSMB_Server
created at2017_04_17
deploymentInternal
confidenceMedium
signature severityCritical
updated at2024_03_07

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!