MS08_067_Exploit_Hacktools_CN

rule MS08_067_Exploit_Hacktools_CN {
   meta:
      description = "Disclosed hacktool set - file cs.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "a3e9e0655447494253a1a60dbc763d9661181322"
      id = "c15836c7-e739-5cc0-9d41-d651ea3e4738"
   strings:
      $s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
      $s3 = "Make SMB Connection error:%d" fullword ascii
      $s5 = "Send Payload Over!" fullword ascii
      $s7 = "Maybe Patched!" fullword ascii
      $s8 = "RpcExceptionCode() = %u" fullword ascii
      $s11 = "ph4nt0m" fullword wide
      $s12 = "\\\\%s\\IPC" ascii
   condition:
      4 of them
}