AAEAAAD/////AQAAAAAAAAAMAgAAAF9TeXN0ZW0u[...]0KPC9PYmpzPgs=

This is a sample base64-encoded .NET serialized object, often used as an indicator of compromise (IOC) in detection procedures. It represents a binary serialized payload that could contain embedded malicious code, such as a gadget chain for deserialization attacks. Use this pattern to search files or network captures for similar structures.

Embed this in detection rules (e.g., YARA signatures or regex searches) to identify serialized objects in files (.dat, .bin, .ser) or traffic. In the [[procedures/Detect-.NET-Serialization-Attacks]] procedure, reference it as a pattern in file scans to flag potential attack artifacts. Decode with tools like ysoserial.net for analysis, but avoid deserializing untrusted samples.

• Search for the header 'AAEAAAD' in binary files or base64 traffic.
• Monitor for deserialization errors in .NET app logs.
• Use EDR tools to alert on processes accessing serialization libraries with this pattern.

• [[procedures/Detect-.NET-Serialization-Attacks]]
• [[techniques/Software Discovery|T1518 - Software Discovery]]