Metasploit SMB2.0 exploit detection rule

alert any any -> any 445 (flow:established, to_server; content:”|00000352ff534d4272000000001853c81702|”; offset:0; depth:18)

Advertisements

About this entry