Is there an IPS Signature for cve-2020-0796 "EternalDarkness" yet?

[wohlebnt_HZA]

It seems that many other vendors have release a signature for cve-2020-0796 which is a wormable remote code execution (RCE) vulnerability in Microsoft Server Message Block 3.1.1 (SMBv3) also known as EternalDarkness. Unfortunately my NSM version does not support Snort rules, so I have to rely on McAfee to provide a signature for this vulnerability. Is there any information regarding a signature for this for the NSP?

[wohlebnt_HZA]

If someone has an updated NSM which allows custom snort rules you can implement the following snort rule for compressed SMBv3 traffic.

###############

# Rules by Claroty
# This rules will detect SMB compressed communication by the SMB protocol identifier.

# The use of the offset and depth parameter is designed to prevent false positives and to allow the NetBios Layer

###############
alert tcp any any -> any 445 (msg:"Claroty Signature: SMBv3 Used with compression - Client to server"; content:"|fc 53 4d 42|"; offset: 0; depth: 10; sid:1000001; rev:1; reference:url,//blog.claroty.com/advisory-new-wormable-vulnerability-in-microsoft-smbv3;)

alert tcp any 445 -> any any (msg:"Claroty Signature: SMBv3 Used with compression - Server to client"; content:"|fc 53 4d 42|"; offset: 0; depth: 10; sid:1000002; rev:1; reference:url,//blog.claroty.com/advisory-new-wormable-vulnerability-in-microsoft-smbv3;)

Source: https://github.com/ClarotyICS/CVE2020-0796/blob/master/snort_rules/smbv3_compressed_data.rules

[fkazi04 · Accepted solution]

Hi @wohlebnt_HZA 

Coverage for CVE-2020-0796 has been released on 10th March Signature set version (10.8.7.2). Kindly upgrade to the latest signature and you should be able to find via CVE ID.