NexurAI
Pre-auth network flaws that self-propagate across the LAN - WannaCry and BlueKeep territory.
A buffer overflow in SMBv1 enables remote code execution - the wormable flaw behind WannaCry and NotPetya.
Windows SMBv1 (MS17-010) · 2017
The attacker sends crafted SMBv1 packets to a listening host (445/tcp), gains kernel-level RCE, then self-propagates across the network without user interaction.
Alert on SMBv1 use, internal 445/tcp scanning and lateral spread, MS17-010 exploit signatures in IDS, and DoublePulsar implant checks.
Patch MS17-010, disable SMBv1 entirely, and segment/limit 445/tcp between hosts.
An integer overflow in SMBv3 compression allows wormable, unauthenticated remote code execution against exposed SMB.
Windows SMBv3 compression (SMBv3.1.1) · 2020
The attacker sends a crafted compressed SMBv3 packet to a listening host, triggering the overflow for kernel-level RCE with worm potential.
Alert on SMBv3 compression use, internal 445/tcp scanning and exploit signatures, and SMB service crashes.
Patch, disable SMBv3 compression as a stopgap, and block/limit 445/tcp between hosts.
A pre-authentication use-after-free in RDP allows wormable remote code execution against exposed 3389/tcp.
Windows Remote Desktop Services (RDP) · 2019
The attacker sends crafted RDP requests to a vulnerable host before authentication, achieving RCE - with worm potential across RDP-exposed networks.
Alert on internet-exposed 3389/tcp, RDP scanning, and BlueKeep exploit signatures; watch for RDP service crashes.
Patch, require Network Level Authentication (NLA), and keep RDP off the internet (VPN/gateway only).
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.