WannaCry EternalBlue MS17-010 SMB Trans2 SESSION_SETUP Overflow

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•8

Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.