NexurAI
Self-propagating remote code execution - how WannaCry and its kin spread without a click.
The scariest CVEs need no click and spread on their own. This path studies wormable remote code execution - the class behind WannaCry and NotPetya - so you understand how a single exposed service becomes a network-wide outbreak, and how to contain it fast.
A buffer overflow in SMBv1 enables remote code execution - the wormable flaw behind WannaCry and NotPetya.
Windows SMBv1 (MS17-010) · 2017
The attacker sends crafted SMBv1 packets to a listening host (445/tcp), gains kernel-level RCE, then self-propagates across the network without user interaction.
Alert on SMBv1 use, internal 445/tcp scanning and lateral spread, MS17-010 exploit signatures in IDS, and DoublePulsar implant checks.
Patch MS17-010, disable SMBv1 entirely, and segment/limit 445/tcp between hosts.
A pre-authentication use-after-free in RDP allows wormable remote code execution against exposed 3389/tcp.
Windows Remote Desktop Services (RDP) · 2019
The attacker sends crafted RDP requests to a vulnerable host before authentication, achieving RCE - with worm potential across RDP-exposed networks.
Alert on internet-exposed 3389/tcp, RDP scanning, and BlueKeep exploit signatures; watch for RDP service crashes.
Patch, require Network Level Authentication (NLA), and keep RDP off the internet (VPN/gateway only).
An integer overflow in SMBv3 compression allows wormable, unauthenticated remote code execution against exposed SMB.
Windows SMBv3 compression (SMBv3.1.1) · 2020
The attacker sends a crafted compressed SMBv3 packet to a listening host, triggering the overflow for kernel-level RCE with worm potential.
Alert on SMBv3 compression use, internal 445/tcp scanning and exploit signatures, and SMB service crashes.
Patch, disable SMBv3 compression as a stopgap, and block/limit 445/tcp between hosts.
A wormable heap overflow in Windows DNS Server allows remote code execution as SYSTEM - and DNS servers are usually Domain Controllers.
Windows DNS Server (SIG record parsing) · 2020
The attacker triggers the server to process an oversized DNS response (SIG record), overflowing a buffer to gain SYSTEM-level RCE, with worm potential across DNS servers.
Alert on abnormally large DNS responses/TCP DNS to your servers, DNS service crashes, and post-exploitation from DNS/DC hosts.
Patch immediately; as a stopgap set the max TCP DNS response length registry value, then reboot.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.