Turla STOCKSTAY STOCKTRADER WMI System Info Discovery via StockMarket Processes

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects the STOCKSTAY/STOCKTRADER backdoor performing system discovery via WMI queries (Win32_OperatingSystem, Win32_Processor, or Win32_ComputerSystem). The detection identifies suspicious WMI activity originating from or associated with processes named after known Turla StockMarket components.