ET EXPLOIT Possible ECLIPSEDWING MS08-067

alert smb any any -> $HOME_NET any (
    msg:"ET EXPLOIT Possible ECLIPSEDWING MS08-067";
    flow:to_server,established;
    content:"|ff|SMB|2f 00 00 00 00|"; offset:4; depth:9;
    content:"|00 00 00 00 ff ff ff ff 08 00|"; distance:30; within:10;
    content:"|2e 00 00 00 00 00 00 00 2e 00 00 00|"; distance:0;
    content:"|2f 00 41 00 2f 00 2e 00 2e 00 2f 00|"; within:12; fast_pattern;
    content:"|2e 00 00 00 00 00 00 00 2e 00 00 00|"; distance:0;
    content:"|2f 00 41 00 2f 00 2e 00 2e 00 2f 00|"; within:12;
    content:"|2f 00 41 00 2f 00 2e 00 2e 00 2f 00|"; distance:0;
    content:"|2f 00 41 00 2f 00 2e 00 2e 00 2f 00|"; distance:0;
    isdataat:800,relative;
    classtype:trojan-activity;
    sid:2024215; rev:1;
    metadata:attack_target SMB_Server, created_at 2017_04_17, deployment Internal, confidence Medium, signature_severity Critical, updated_at 2019_07_26;
)