ET EXPLOIT Suspicious SVCCTL CreateService Command via SMB - Observed Zerologon Post Compromise Activity

alert tcp any any -> $HOME_NET 445 (
    msg:"ET EXPLOIT Suspicious SVCCTL CreateService Command via SMB - Observed Zerologon Post Compromise Activity";
    flow:established,to_server;
    content:"SMB"; depth:8;
    content:"|09 00|"; distance:8; within:2;
    content:"|05 00 00|"; distance:0;
    content:"|0c 00|"; distance:19; within:2;
    content:"|15 00 00 00 00 00 00 00 15 00 00 00|"; within:32;
    pcre:"/^(?:[A-Z]\x00){20}\x00\x00/R";
    content:"|15 00 00 00 00 00 00 00 15 00 00 00|"; fast_pattern; distance:6; within:12;
    pcre:"/^(?:[A-Z]\x00){20}\x00\x00/R";
    content:"|03 00 00 00|"; distance:10; within:4;
    reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/;
    reference:md5,59e7f22d2c290336826700f05531bd30;
    classtype:attempted-admin;
    sid:2035287; rev:2;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Server, created_at 2022_02_25, deployment Internal, confidence High, signature_severity Major, updated_at 2022_02_25;
)