Turla STOCKSTAY STOCKTRADER WMI Process Enumeration via ManagementObjectSearcher

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects the execution of known Turla STOCKSTAY/STOCKTRADER backdoor components that use WMI via the ManagementObjectSearcher class to perform system reconnaissance. The rule monitors for unauthorized child process spawning of WmiPrvSE.exe by identified malicious executable files, indicating active system and process information gathering.