Turla STOCKSTAY HTA Lure Execution from Suspicious User Directories
Detects the execution of mshta.exe with a .hta file path located in common user-writable directories (Temp, Downloads, AppData, User Profile) accompanied by suspicious filename themes often associated with phishing or social engineering, such as military, salary, or diplomatic lures.
Splunk (SPL)
