Turla STOCKSTAY K1MORPHER-obfuscated .NET assembly execution (ClientMNGR2.exe/GR3.exe)
Detects the execution of malicious .NET assemblies associated with the Turla group's STOCKSTAY malware family. The rule identifies specific file names (ClientMNGR2.exe, GR3.exe) and known SHA256 hashes indicative of these assemblies, which utilize the K1MORPHER string obfuscation technique.
YARA-L
