Detecting SMB Cover Channel "Doublepulsar"

https://isc.sans.edu/forums/diary/Detecting+SMB+Covert+Channel+Double+Pulsar/22312/

ETERNALBLUE: Windows SMBv1 Exploit

https://isc.sans.edu/forums/diary/ETERNALBLUE+Windows+SMBv1+Exploit+Patched/22304/