alert udp any any -> any any (msg:"🐾 - 🚨 VxWorks WDB Agent 🧠 memory dump launched over RPC 🥷 - T1003"; flow:to_server, stateless; content:"|02 55 55 55 55 00 00 00 01 00 00 00 0a|"; fast_pattern; content:"|ff ff 4f 7c|"; distance:16; content:"|3c 00 00 00 04 00 00 00 00 00 00 05 8c|"; distance:3; content:"|00 00 00|"; endswith; target:dest_ip; reference:url,https://www.windriver.com/products/embedded/vxworks; reference:url,https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb; metadata:created_at 2026_05_15, updated_at 2026_05_15, signature_severity Major, attack_target OT, affected_product VxWorks, mitre_tactic_id TA0006, mitre_tactic_name Credential_Access, mitre_technique_id T1003, mitre_technique_name OS_Credential_Dumping; sid:3321486; rev:1; classtype:targeted-activity;)