DNS Query To Katz Stealer Domains

calendar May 26, 2025 · attack.command-and-control attack.t1071.004 detection.emerging-threats  ·
Share on: linkedin copy

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

Sigma rule (View on GitHub)

 1title: DNS Query To Katz Stealer Domains
 2id: 9c3d6e32-f4c8-4d73-8b8f-95c3b383a13c
 3related:
 4    - id: 6b0c762f-0e1b-435f-a829-5943b08fe36a
 5      type: similar
 6status: experimental
 7description: |
 8    Detects DNS queries to domains associated with Katz Stealer malware.
 9    Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
10    In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.    
11references:
12    - Internal Research
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2025-05-22
15tags:
16    - attack.command-and-control
17    - attack.t1071.004
18    - detection.emerging-threats
19logsource:
20    product: windows
21    category: dns_query
22detection:
23    selection:
24        QueryName|contains:
25            - 'katz-panel.com'
26            - 'katz-stealer.com'
27            - 'katzstealer.com'
28            - 'twist2katz.com'
29    condition: selection
30falsepositives:
31    - Unlikely
32level: high

References

Related rules

to-top