ysoserial .NET gadget chain strings in HTTP POST to SharePoint

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects HTTP POST requests to SharePoint ToolPane or WebPartPage endpoints containing serialized gadget chains (e.g., ysoserial ExpandedWrapper/ObjectDataProvider or XamlServices) indicative of deserialization exploitation attempts, specifically targeting CVE-2026-65660.