Turla STOCKSTAY Malware Known Filename Execution
This rule detects the creation or execution of files that match specific suspicious filenames associated with known malicious activity. It monitors both process creation (Event ID 1) and file creation (Event ID 11) events, targeting filenames such as 'MicrosoftUpdateOneDrive.exe', 'StockMarketView.exe', and various DLL files (e.g., 'ms-lib-math-core.dll'). These files are often masquerading as legitimate system or application components to evade detection.
Splunk (SPL)
