Turla STOCKSTAY Persistence via Registry Run Key and AppInit_DLLs

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•7

Detects persistence mechanisms used by the Turla STOCKSTAY malware, specifically identifying the use of Registry Run keys (masquerading as 'MicrosoftUpdateOneDrive' or referencing the %LOCALAPPDATA%\Programs\SMN\ directory) and modifications to the AppInit_DLLs registry key.