Turla STOCKSTAY IPC: .NET process named pipe creation with outbound network

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects processes that load .NET runtime assemblies (clr.dll/coreclr.dll) from non-standard paths while concurrently performing named pipe inter-process communication and initiating outbound network connections. This behavior is often indicative of fileless execution, living-off-the-land techniques, or lateral movement where a process is repurposed as a proxy or command-and-control conduit.