Did you enable the APC Prevention ? From my memory this should be the feature to block MS17-010 attack. This settings is per default still off in sophos central threat prevention policy.
↧