ET EXPLOIT Possible ETERNALBLUE MS17-010 Heap Spray

Query · suricata

flow:to_server,established;
content:"|ff|SMB|33 00 00 00 00 18 07 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ff fe 00 08|"; offset:4; depth:30; fast_pattern;
content:"|00 09 00 00 00 10|"; distance:1; within:6;
content:"|00 00 00 00 00 00 00 10|"; within:8;
content:"|00 00 00 10|"; distance:4; within:4;
pcre:"/^[a-zA-Z0-9+/]{1000,}/R";
threshold:type both, track by_src, count 3, seconds 30;
Raw source ET EXPLOIT Possible ETERNALBLUE MS17-010 Heap Spray · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert smb any any -> $HOME_NET any (
    msg:"ET EXPLOIT Possible ETERNALBLUE MS17-010 Heap Spray";
    flow:to_server,established;
    content:"|ff|SMB|33 00 00 00 00 18 07 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ff fe 00 08|"; offset:4; depth:30; fast_pattern;
    content:"|00 09 00 00 00 10|"; distance:1; within:6;
    content:"|00 00 00 00 00 00 00 10|"; within:8;
    content:"|00 00 00 10|"; distance:4; within:4;
    pcre:"/^[a-zA-Z0-9+/]{1000,}/R";
    threshold:type both, track by_src, count 3, seconds 30;
    classtype:trojan-activity;
    sid:2024217; rev:4;
    metadata:attack_target SMB_Server, created_at 2017_04_17, deployment Internal, confidence Medium, signature_severity Critical, updated_at 2022_03_17;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.