Turla STOCKSTAY Multi-Source System Discovery Burst (5+ signals/2min)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects high-volume host discovery activity, specifically a process executing 5 or more distinct system or network discovery queries (via WMI or command line) within a 2-minute window. This behavior is indicative of Turla's STOCKSTAY or STOCKTRADER victim profiling phase, where an actor maps the target environment's configuration, network, and user information.