Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
65 detections
Filters
Last updated
All Time
Detection languages
24
18
11
10
2
Contributors
20
15
9
7
5
Categories
29
13
12
10
9
Platforms
53
12
1
1
1
Products / Services
21
16
10
10
6
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
1
IDS Classtypes
7
3
IDS Protocols
10
Detects the spawning of DllHost.exe (a Windows COM surrogate process) by identified STOCKSTAY malware components or via suspicious msiexec installations targeting STOCKSTAY directories. This behavior is indicative of inter-process communication (IPC) used by Turla's STOCKSTAY malware suite.
Detects .NET AppDomainManager injection, a technique used by the Turla threat group (specifically STOCKSTAY.MARKETMAKER), by monitoring registry modifications to the .NETFramework key. An attacker can set AppDomainManagerAssembly and AppDomainManagerType to force the Common Language Runtime (CLR) to load a malicious DLL whenever a .NET process starts, facilitating persistent code execution.
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
Detects the execution of mshta.exe followed by the execution of a .dat file, consistent with the Turla STOCKSTAY campaign. The rule monitors for mshta.exe spawning suspicious processes or executing payloads masquerading as data files (e.g., styles.dat) to achieve malicious functionality.
Detects a suspicious sequence of events where a user initiates an outbound RDP connection using mstsc.exe on port 3389, followed shortly by the execution of a file named MicrosoftUpdateOneDrive.exe. This behavior is indicative of the Turla threat group deploying their STOCKSTAY.MARKETMAKER malware via an RDP-based phishing lure.
Detects the execution of arbitrary processes by Turla STOCKSTAY/STOCKTRADER malware components (SMEditor.exe, SMNet.exe, StockMarketView.exe, MicrosoftUpdateOneDrive.exe) located within the %LOCALAPPDATA%\Programs\SMN\ directory. The detection focuses on identifying child processes spawned by these known backdoor components, which typically utilize windowless execution with stdout redirection.
Detects STOCKSTAY malware masquerading as an ILSpy installer using malicious MSI files (Copia.msi, DiplomacyEduAI.msi). The rule identifies the execution of a decoy lure URL through a custom OpenUrl MSI action that triggers the spawning of viewer.exe, as well as file activity associated with the installation path '%LOCALAPPDATA%/Programs/SMN/'.
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
Detects network traffic associated with the Turla group's STOCKSTAY malware, specifically identifying outbound WebSocket upgrade requests directed to the known command-and-control domain weatherdataai.theworkpc.com.
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
Detects HTTP GET requests for specific malicious archives (calculator.rar, EditorToolsPdf.zip) originating from suspected compromised Ukrainian domains (basecon.com.ua, online.zp.ua). This behavior is associated with the STOCKSTAY malware used by the threat actor Turla.
Detects pip installing the benign-looking termncolor package together with colorinal. This dependency relationship was used to conceal delivery of platform-specific ZiChatBot droppers, as observed in campaigns attributed to OceanLotus (APT32). The rule specifically looks for command-line executions of pip or python with 'pip install' and the presence of 'termncolor', 'colorinal', or 'uuid32-utils' in the command line.
Detects the execution of malicious .NET assemblies associated with the Turla group's STOCKSTAY malware family. The rule identifies specific file names (ClientMNGR2.exe, GR3.exe) and known SHA256 hashes indicative of these assemblies, which utilize the K1MORPHER string obfuscation technique.
Detects the execution or file creation of identified Turla STOCKSTAY malware components, specifically targeting a list of known malicious filenames and installers used by this actor.
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
Detects evidence of Turla STOCKSTAY malware performing environmental keying via WMI system discovery (collecting OSVersion, MachineName, and UserName) followed by the execution of components from the specific %LOCALAPPDATA%\Programs\SMN\ directory. This behavior suggests the malware is using system-specific attributes to decrypt configuration or verify the environment before proceeding.
Detects the simultaneous presence of STOCKSTAY STOCKBROKER, STOCKMARKET, and STOCKTRADER .NET process components on a single host. This specific combination of processes is indicative of the Turla group's STOCKSTAY malware architecture, which utilizes Windows WM_COPYDATA for inter-process communication.
Detects screen capture behavior associated with the Turla group's STOCKSTAY/STOCKTRADER malware. The rule identifies a process running from the '%LOCALAPPDATA%/Programs/SMN/' directory generating multiple image files (png, bmp, jpg, jpeg), which is consistent with the malware's functionality of capturing and encoding screenshots for exfiltration.
Detects the execution of known Turla STOCKSTAY/STOCKTRADER backdoor components that use WMI via the ManagementObjectSearcher class to perform system reconnaissance. The rule monitors for unauthorized child process spawning of WmiPrvSE.exe by identified malicious executable files, indicating active system and process information gathering.
This rule detects persistence mechanisms associated with the Turla STOCKSTAY backdoor. It monitors for the creation or modification of Registry Run keys, the execution of msiexec for suspicious MSI package installations (DiplomacyEduAI.msi, Copia.msi), and the presence of known STOCKSTAY component executables (e.g., MicrosoftUpdateOneDrive.exe, SMEditor.exe) in the %LOCALAPPDATA%/Programs/SMN/ directory.
Detects a script process (wscript.exe or cscript.exe) creating files in a specific HP-themed directory (e.g., 'Programs\HP\Printer\Driver') and subsequently establishing persistence by creating a Run key in the registry that points to an executable within that same HP-themed path. This behavior is indicative of the Turla Kazuar VBScript dropper.
Page 2 of 4