Turla STOCKSTAY.MARKETMAKER .NET AppDomainManager Injection via Registry

Ethan Andrews@eandrews

•updated Jun 25, 2026•4•0•4

Detects .NET AppDomainManager injection, a technique used by the Turla threat group (specifically STOCKSTAY.MARKETMAKER), by monitoring registry modifications to the .NETFramework key. An attacker can set AppDomainManagerAssembly and AppDomainManagerType to force the Common Language Runtime (CLR) to load a malicious DLL whenever a .NET process starts, facilitating persistent code execution.