.NET Deserialization Guard Bypass Attempt
Detects an attempt to disable .NET deserialization safeguards by modifying the 'disableActivitySurrogateSelectorTypeCheck' field. This technique was observed in an APT36 campaign where it was used to prepare the environment for the in-memory execution of a malicious DLL via unsafe deserialization.
Sigma
