Turla STOCKSTAY MicrosoftUpdateOneDrive Run Key Persistence via SMN Directory
Detects the Turla threat group's STOCKSTAY malware establishing persistence by creating a registry entry in the HKCU Run key. The persistence mechanism points to 'MicrosoftUpdateOneDrive.exe' located in the '%LOCALAPPDATA%\Programs\SMN\' directory.
YARA-L
