This indicates an attack attempt to exploit a Remote Code Execution vulnerability in Microsoft SMB Servers.
The vulnerability is due to an error when the vulnerable software handles a maliciously crafted SMBv1 request. A remote attacker may be able to exploit this to execute arbitrary code within the context of the application, via a crafted request. This vulnerability was leaked as part of the Shadow Brokers leak and is code-named EternalBlue. It has been exploited in the wild and is also linked to the Wannacry ransomware attack.
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012 and Windows Server 2012 R2
Windows RT 8.1
Windows Server 2016
Windows Server Core installation option
System Compromise: Remote attackers can gain control of vulnerable systems.
Apply the most recent upgrade or patch from the vendor.
|IPS (Regular DB)
|IPS (Extended DB)