EternalBlue MS17-010 Exploitation via SOCKS5 Pivot to Internal 10.39.x.x

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects network connections over SMB (port 445) targeting internal IP ranges initiated by common penetration testing or scripting tools (e.g., Python, msfconsole), or attempts containing known exploit strings such as 'eternalblue', 'ms17-010', or 'WinboxExploit'. This behavior is indicative of lateral movement, reconnaissance, or exploitation attempts within the network.