alert smb $HOME_NET any -> $HOME_NET any (msg:"ET MALWARE Shamoon v3 32bit Propagating Internally via SMB"; flow:to_server,established; content:"|00 00 00 00 00 00|"; within:60; content:"MZ"; distance:2; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; content:"|41 8A 14 02 8B 45|"; distance:0; content:"|32 14 30 88 16 3B CB 72|"; distance:1; within:8; fast_pattern; reference:url,www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/new-version-of-disk-wiping-shamoon-disttrack-spotted-what-you-need-to-know; classtype:trojan-activity; sid:2026732; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Server, created_at 2018_12_14, deployment Perimeter, malware_family Shamoon, performance_impact Low, confidence Medium, signature_severity Major, tag SMB, tag Worm, tag Wiper, updated_at 2020_08_19;)