alert http any any -> any any (msg:"🐾 - 🚨 Wing FTP Server RCE CVE-2025-47812 exploit successful 💥"; flow:to_client, stateless; flowbits:isset,pptrls.cve-2025-47812; http.stat_code; content:"200"; http.content_type; content:"text/html"; http.server; content:"Wing FTP Server"; startswith; http.response_body; content:"| 77 65 6c 63 6f 6d 65 4d 65 73 73 61 67 65|"; reference:url,https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/; reference:url,https://www.huntress.com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild; reference:url,https://github.com/4m3rr0r/CVE-2025-47812-poc; target:src_ip; metadata:created_at 2025_07_12, updated_at 2025_07_12; sid:3321450; rev:5; classtype:targeted-activity;)