Turla STOCKSTAY MSI OpenUrl Decoy Action Spawning viewer.exe via msiexec

Ethan Andrews@eandrews

•updated Jun 25, 2026•1•0•3

Detects STOCKSTAY malware masquerading as an ILSpy installer using malicious MSI files (Copia.msi, DiplomacyEduAI.msi). The rule identifies the execution of a decoy lure URL through a custom OpenUrl MSI action that triggers the spawning of viewer.exe, as well as file activity associated with the installation path '%LOCALAPPDATA%/Programs/SMN/'.