Turla STOCKSTAY Business-Hours .NET WebSocket C2 Beaconing

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects processes that load .NET-related modules (clr.dll or dotnet.exe) and maintain a network connection (port 80 or 443) for more than one hour during standard business hours. This behavior is indicative of potentially persistent, long-running .NET-based applications or potentially malicious tools maintaining persistence and C2 communication.