alert smb $HOME_NET any -> $HOME_NET any (msg:"ET MALWARE Shamoon v3 64bit Propagating Internally via SMB"; flow:to_server,established; content:"|00 00 00 00 00 00|"; content:"MZ"; distance:2; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; content:"|48 FF C5 42 0F B6|"; distance:0; fast_pattern; content:"|32 45|"; distance:2; within:2; content:"|41 88 41 FF|"; distance:1; within:4; reference:url,www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/new-version-of-disk-wiping-shamoon-disttrack-spotted-what-you-need-to-know; classtype:trojan-activity; sid:2026733; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Server, created_at 2018_12_14, deployment Perimeter, malware_family Shamoon, performance_impact Low, confidence Medium, signature_severity Major, tag SMB, tag Worm, tag Wiper, updated_at 2019_07_26;)