alert udp any any -> any any (msg:"🐾 - 🚨 VxWorks WDB Agent 🦸 administration operation started over RPC 🥷 - T1219"; flow:to_server, stateless; content:"|02 55 55 55 55 00 00 00 01 00 00 00 02|"; fast_pattern; content:"|ff ff 55 10|"; distance:16; content:"|3c 00 00 00 02 00 00 00 02|"; distance:3; content:"|00 00 00|"; endswith; target:dest_ip; reference:url,https://www.windriver.com/products/embedded/vxworks; reference:url,https://www.kb.cert.org/vuls/id/362332/; metadata:created_at 2026_05_15, updated_at 2026_05_15, signature_severity Major, attack_target OT, affected_product VxWorks, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1219, mitre_technique_name Remote_Access_Tools; sid:3321487; rev:1; classtype:targeted-activity;)