ET EXPLOIT Possible ETERNALROMANCE MS17-010 Heap Spray

alert smb any any -> $HOME_NET any (
    msg:"ET EXPLOIT Possible ETERNALROMANCE MS17-010 Heap Spray";
    flow:to_server,established;
    content:"|ff|SMB|25 00 00 00 00 18|"; offset:4; depth:10;
    content:"|07 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08|"; fast_pattern; within:16;
    content:"|00 08|"; distance:2; within:2;
    content:"|0e 00 00 40 00|"; distance:2; within:5;
    content:"|00 00 00 00 00 00 01 00 00 00 00 00 00 00 00|"; distance:2; within:15;
    content:"|00 00 00 00 00 00 00 00 00|"; endswith;
    threshold:type threshold, track by_src, count 20, seconds 1;
    classtype:trojan-activity;
    sid:2024219; rev:2;
    metadata:attack_target SMB_Server, created_at 2017_04_17, deployment Internal, confidence Medium, signature_severity Critical, updated_at 2019_09_28;
)