Turla STOCKSTAY STOCKTRADER Screenshot Capture via WM_COPYDATA IPC

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects screen capture behavior associated with the Turla group's STOCKSTAY/STOCKTRADER malware. The rule identifies a process running from the '%LOCALAPPDATA%/Programs/SMN/' directory generating multiple image files (png, bmp, jpg, jpeg), which is consistent with the malware's functionality of capturing and encoding screenshots for exfiltration.