alert tcp any any -> any 445 (msg:"ATTACK [PTsecurity] Webexservice Service Probe (CVE-2018-15442)"; flow:established, to_server, no_stream; content:"SMB"; depth:8; content:"|05 00 00|"; distance:0; content:"|10 00|"; distance:19; within:3; content:"w|00|e|00|b|00|e|00|x|00|s|00|e|00|r|00|v|00|i|00|c|00|e|000000|"; nocase; distance:0; reference:url, webexec.org; reference:cve, 2018-15442; flowbits:set, CVE.2018-15442.Probe; classtype:attempted-admin; reference:url, github.com/ptresearch/AttackDetection; sid:10003982; rev:1;)