EternalBlue/SMBGhost exploitation scripts executed via SOCKS5 pivot

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects the execution of known SMB exploitation tools (e.g., Python-based SMBGhost scanners/payloads, Metasploit resource scripts for EternalBlue) and identifies high-fan-out SMB scanning activity or unauthorized SMB connections from non-standard processes to an internal subnet (10.39.x.x).