detection.wiki

Detection rules › Sigma

Katz Stealer Suspicious User-Agent

Status
experimental
Severity
high
Log source
product zeek, service http
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.

Known false positives

  • Unlikely

MITRE ATT&CK coverage

TacticTechniques
Command & Control

Rule body

title: Katz Stealer Suspicious User-Agent
id: 834c6d2f-5e98-4b2a-b453-0c4f234afedd
status: experimental
description: |
    Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.
references:
    - Internal Research
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-05-22
tags:
    - attack.command-and-control
    - attack.t1071.001
    - detection.emerging-threats
logsource:
    product: zeek
    service: http
detection:
    selection:
        user_agent|contains: 'katz-ontop'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    user_agent|contains: 'katz-ontop'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
user_agentmatch
  • katz-ontop
field:"aws::userAgent" kind:match value:"katz-ontop"