Microsoft · SMBv1
The SMBv1 server in Microsoft Windows (including Vista SP2, Server 2008, Windows 7, 8.1, 10, and Server 2012 and 2016 editions) contains an improper input validation flaw in how it handles crafted packets. A remote attacker with network access and low-privilege authentication can send such packets without any user interaction to execute arbitrary code on the affected system.
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
First seen exploited 11 months before it was disclosed. Public exploit code (Metasploit) was available 3 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Arbitrary code execution resulting from exploitation
allows remote attackers to execute arbitrary code via crafted packets
Remote exploitation of SMB service via crafted packets; TRAM2 annotated sentence label
allows remote attackers to execute arbitrary code via crafted packets
It spreads to Microsoft Windows machines using several propagation methods, including the EternalBlue exploit for the CVE-2017-0144 vulnerability in the SMB service. This is the same vulnerability Microsoft reported on in MS17-010, which was exploited so successfully in the recent WannaCry ransomware outbreak.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2017-0144 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Brute forcing RDP accounts, the dumping of credentials, and the use of *legacy* exploits such as EternalBlue (CVE-2017-0144), are ways to quickly obtain access to one or more privileged accounts.
It spreads to Microsoft Windows machines using several propagation methods, including the EternalBlue exploit for the CVE-2017-0144 vulnerability in the SMB service.
CVE-2017-0144, respectively) to spread within the network and deploy InvisiMole’s backdoors or downloaders.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.