Turla STOCKSTAY MicrosoftUpdateOneDrive Run Key Persistence Outside Legitimate Paths
Detects modifications to Windows Registry 'Run' or 'RunOnce' keys involving specific values ('MicrosoftUpdate', 'OneDrive') that do not originate from standard Microsoft or OneDrive installation directories. The rule correlates registry changes with process execution events to identify potentially malicious persistence mechanisms.
Microsoft Sentinel (KQL)
