SMBGhost (CVE-2020-0796) Suricata Rule (Created This as quickly as possible, it has not been tested)

README.md

Overview

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server. To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.

Rule

Make sure that firewall rules on the border firewall and on endpoints prevent (block) inbound and outbound connections to the vulnerable service (445 TCP) if applicable.

Please leave comment if this needs to be edited to make it work better.

SMBGhost.rules

alert tcp $EXTERNAL_NET -> $HOME_NET 445 (msg:"Claroty Signature: SMBv3 Used with compression - Server to client"; flow: to_server, established, no_stream; content:"|fc 53 4d 42|"; offset: 0; depth: 10;reference:cve,CVE-2020-0796;reference:URL,https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796;classtype:misc-activity;sid:20200796;rev:1;)
alert tcp $HOME_NET 445 -> $EXTERNAL_NET (msg:"Claroty Signature: SMBv3 Used with compression - Server to client"; flow: to_server, established, no_stream; content:"|fc 53 4d 42|"; offset: 0; depth: 10;reference:cve,CVE-2020-0796;reference:URL,https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796;classtype:misc-activity;sid:20200796;rev:1;)