.NET Deserialization Gadget Detection for Remcos Loader

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•2

This rule detects the use of .NET deserialization gadgets, often associated with malware loaders like Remcos RAT, by monitoring process command lines for specific keywords such as 'ObjectInputStream', 'DeserializeObject', 'BinaryFormatter', or 'NetDataContractSerializer'. It further refines detection by looking for processes with file names starting with 'GST' or specifically 'Optimax.dll', which are indicators of the Remcos loader.