ET EXPLOIT Possible ETERNALBLUE Exploit M3 MS17-010

alert smb any any -> $HOME_NET any (
    msg:"ET EXPLOIT Possible ETERNALBLUE Exploit M3 MS17-010";
    flow:to_server,established;
    content:"|ff|SMB|32 00 00 00 00 18 07 c0|"; offset:4; depth:12;
    content:"|00 00 00 00 00 00 00 00 00 00 00 08 ff fe 00 08|"; distance:2; within:16; fast_pattern;
    content:"|0f 0c 00 00 10 01 00 00 00 00 00 00 00 f2 00 00 00 00 00 0c 00 42 00 00 10 4e 00 01 00 0e 00 0d 10 00|"; distance:2; within:34;
    isdataat:1000,relative;
    threshold:type both, track by_src, count 10, seconds 1;
    classtype:trojan-activity;
    sid:2024430; rev:3;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_06_27, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Critical, updated_at 2019_07_26;
)