Rule History

alert smb any any -> any any (msg: "ATTACK AD [PTsecurity] Successful ETERNALCHAMPION attack (MS17-010 / CVE-2017-0146)"; flow: established, from_server; content: "|FF|SMB|A0|"; content: "Frag"; within: 115; flowbits: isset, EternalRomance.RaceCondition.Attempt; reference: cve, 2017-0146; reference: url, github.com/rapid7/metasploit-framework/commit/c9473f8cbc147fe6ff7fe27862fd3d1e9f27c4f5; reference: url, blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis; reference: url, rules.ptsecurity.com; classtype: successful-admin; sid: 10001720; rev: 1;)