Heyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types

Programmatically create hunting rules for deserialization exploitation with multiple

• keywords (e.g. cmd.exe)
• gadget chains (e.g. CommonsCollection)
• object types (e.g. ViewState, Java, Python Pickle, PHP)
• encodings (e.g. Base64, raw)
• rule types (e.g. Snort, Yara)

Disclaimer

Rules generated by this tool are intended for hunting/research purposes and are not designed for high fidelity/blocking purposes.

Please test thoroughly before deploying to any production systems.

The Yara rules are primarily intended for scanning web server logs. Some of the "object prefixes" are only 2 …

deserialization exploitation hunting rules yara rule generator ysoserial