ET DOS Microsoft Windows LSASS Remote Memory Corruption (CVE-2017-0004)

alert tcp any any -> $HOME_NET 445 (
    msg:"ET DOS Microsoft Windows LSASS Remote Memory Corruption (CVE-2017-0004)";
    flow:established,to_server;
    content:"|FF|SMB|73|"; offset:4; depth:5;
    byte_test:1,&,0x80,6,relative;
    byte_test:1,&,0x08,6,relative;
    byte_test:1,&,0x10,5,relative;
    byte_test:1,&,0x04,5,relative;
    byte_test:1,&,0x02,5,relative;
    byte_test:1,&,0x01,5,relative;
    content:"|ff 00|"; distance:28; within:2;
    content:"|84|"; distance:25; within:1;
    content:"NTLMSSP"; fast_pattern; within:64;
    reference:url,github.com/lgandx/PoC/tree/master/LSASS;
    reference:url,support.microsoft.com/en-us/kb/3216771;
    reference:url,support.microsoft.com/en-us/kb/3199173;
    reference:cve,2017-0004;
    reference:url,technet.microsoft.com/library/security/MS17-004;
    classtype:attempted-dos;
    sid:2023497; rev:3;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2016_11_11, cve CVE_2017_0004, deployment Perimeter, deployment Datacenter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2019_07_26;
)