MS17-010 EternalBlue SMBv1 Trans2 SESSION_SETUP Overflow Attempt
Detects network traffic patterns characteristic of the EternalBlue (MS17-010) exploit targeting the SMBv1 protocol. Specifically, it monitors for a malformed SESSION_SETUP request containing an unusually large payload, which is indicative of an attempt to trigger a buffer overflow in the SMB service.
Suricata
