ET MALWARE Shamoon v3 32bit Propagating Internally via SMB

alert smb $HOME_NET any -> $HOME_NET any (
    msg:"ET MALWARE Shamoon v3 32bit Propagating Internally via SMB";
    flow:to_server,established;
    content:"|00 00 00 00 00 00|"; within:60;
    content:"MZ"; distance:2; within:2;
    byte_jump:4,58,relative,little;
    content:"PE|00 00|"; distance:-64; within:4;
    content:"|41 8A 14 02 8B 45|"; distance:0;
    content:"|32 14 30 88 16 3B CB 72|"; distance:1; within:8; fast_pattern;
    reference:url,www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/new-version-of-disk-wiping-shamoon-disttrack-spotted-what-you-need-to-know;
    classtype:trojan-activity;
    sid:2026732; rev:3;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Server, created_at 2018_12_14, deployment Perimeter, malware_family Shamoon, performance_impact Low, confidence Medium, signature_severity Major, tag SMB, tag Worm, tag Wiper, updated_at 2020_08_19;
)