Versions (6)
Version DetailsCurrent
Rev: 2 • Jun 24, 2025, 4:00 PMATTACK AD [PTsecurity] Metasploit MS17-010 ETERNALCHAMPION. Non-Fragmented NT Trans Request with command NT Rename (CVE-2017-0146)
alert smb any any -> any any (msg:"ATTACK AD [PTsecurity] Metasploit MS17-010 ETERNALCHAMPION. Non-Fragmented NT Trans Request with command NT Rename (CVE-2017-0146)"; flow:established, to_server; content:"|FF|SMB|A0|"; offset:4; depth:5; byte_extract:4, 35, NTTrans.TotalDataCount, relative, little; byte_test:4, =, NTTrans.TotalDataCount, 16, relative, little; content:"|05 00|"; distance:25; within:2; isdataat:300, relative; flowbits:set, EternalRomance.RaceCondition.Possible; flowbits:noalert; reference:cve, 2017-0146; reference:url, github.com/rapid7/metasploit-framework/commit/c9473f8cbc147fe6ff7fe27862fd3d1e9f27c4f5; reference:url, blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10001717; rev:2;)
Jun 24, 2025, 4:00 PM
Jun 24, 2025, 4:00 PM
Oct 16, 2025, 10:34 AM
Oct 16, 2025, 10:34 AM
rules/ptopen-windows.rules