Turla STOCKSTAY HTA Lure Executing STOCKSTAY.MARKETMAKER via mshta.exe

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects the execution of mshta.exe followed by the execution of a .dat file, consistent with the Turla STOCKSTAY campaign. The rule monitors for mshta.exe spawning suspicious processes or executing payloads masquerading as data files (e.g., styles.dat) to achieve malicious functionality.