STOCKSTAY Environmental Keying: Registry+WMI+Env Check Without Follow-on Activity
This rule detects a specific environmental keying pattern indicative of malware or reconnaissance tools attempting to identify hostnames and domain membership. It monitors for a sequence of activities occurring within a 30-second window: querying the registry for computer name configuration, executing a WMI query for system information, and querying environment variables. The detection further filters for processes that exhibit this behavior without subsequent network activity or child process creation, which is characteristic of 'silent' environmental keying techniques.
Microsoft Sentinel (KQL)
