EternalBlue MS17-010 Exploit Delivery via SOCKS5 Pivot to Internal SMBv1 Hosts
Detects command-line activity or process execution related to the EternalBlue (MS17-010) exploit suite, commonly used for lateral movement and remote code execution against SMB services (ports 445/139).
Splunk (SPL)
