##! Please refer to the documentation at
##! https://coreruleset.org/docs/development/regex_assembly/.

##! Rule 944240: Java serialization RCE (CVE-2015-4852) - PL2
##!
##! Detects Java deserialization class/method names commonly abused
##! in remote code execution attacks via Apache Commons Collections
##! and related libraries.
##! Same pattern as 944120 (PL1) but without the chained magic bytes check.
##!
##! Note: This rule uses t:lowercase transformation, so all patterns
##! are in lowercase.

##! Apache Commons Collections gadget classes
clonetransformer
forclosure
instantiatefactory
instantiatetransformer
invokertransformer
prototypeclonefactory
prototypeserializationfactory
whileclosure

##! Java property/IO classes used in exploitation chains
getproperty
filewriter

##! XML deserialization
xmldecoder