Turla STOCKSTAY - Malicious DLL Module File Creation or Load
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
Microsoft Sentinel (KQL)
