alert udp any any -> any any (msg:"🐾 - 🚨 VxWorks WDB Agent ⏻ reboot launched over RPC 🥷 - T1529"; flow:to_server, stateless; content:"|02 55 55 55 55 00 00 00 01 00 00 00 02|"; fast_pattern; content:"|ff ff 55 0d|"; distance:16; content:"|3c 00 00 00 05 00 00 00 02|"; distance:3; content:"|00 00 00|"; endswith; target:dest_ip; reference:url,https://www.windriver.com/products/embedded/vxworks; reference:url,https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/vxworks/wdbrpc_reboot.rb; metadata:created_at 2026_05_15, updated_at 2026_05_15, signature_severity Major, attack_target OT, affected_product VxWorks, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1529, mitre_technique_name System_Shutdown-Reboot; sid:3321485; rev:1; classtype:targeted-activity;)