Yara rules to tag artifacts with deserialized and obfuscated code

java-deserialization-obfuscation.yara

rule JavaDeswerializePayload
{
	meta:
		author = "@jnazario"
		date = "2022-01-27"
		version = 1
	
	strings:
		$s1 = "java.lang.Runtime.getRuntime().exec" ascii fullword
		$s2 = "javaSerializedData" ascii fullword
	
	condition:
		all of them
}

rule JavaCharEncodedPayload
{
	meta:
		author = "@jnazario"
		date = "2022-01-27"
		version = 1
	
	strings:
		$s1 = "exec(String.fromCharCode(" ascii fullword
		$s2 = "eval" ascii fullword
	
	condition:
		all of them
}