alert smb any any -> $HOME_NET any (msg:"ET MALWARE 401TRG SMB Create AndX Request For Emotet Spreader"; flow:established,to_server; content:"SMB"; depth:8; content:"|05 00|"; distance:8; within:2; content:"\\|00|m|00|y|00 2E 00|e|00|x|00|e|00|"; nocase; distance:0; reference:url,www.binarydefense.com/emotet-evolves-with-new-wi-fi-spreader/; classtype:command-and-control; sid:2029931; rev:1; metadata:attack_target SMB_Client, created_at 2020_04_17, deployment Perimeter, malware_family Emotet, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_17;)