Turla STOCKSTAY STOCKTRADER Windowless Process Execution via Run Command
Detects the execution of arbitrary processes by Turla STOCKSTAY/STOCKTRADER malware components (SMEditor.exe, SMNet.exe, StockMarketView.exe, MicrosoftUpdateOneDrive.exe) located within the %LOCALAPPDATA%\Programs\SMN\ directory. The detection focuses on identifying child processes spawned by these known backdoor components, which typically utilize windowless execution with stdout redirection.
Microsoft Sentinel (KQL)
