DNS Query To Katz Stealer Domains - Network

calendar May 26, 2025 · attack.command-and-control attack.t1071.004 detection.emerging-threats  ·
Share on: linkedin copy

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

Sigma rule (View on GitHub)

 1title: DNS Query To Katz Stealer Domains - Network
 2id: 6b0c762f-0e1b-435f-a829-5943b08fe36a
 3related:
 4    - id: 9c3d6e32-f4c8-4d73-8b8f-95c3b383a13c
 5      type: similar
 6status: experimental
 7description: |
 8    Detects DNS queries to domains associated with Katz Stealer malware.
 9    Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
10    In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.    
11references:
12    - Internal research
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2025-05-22
15tags:
16    - attack.command-and-control
17    - attack.t1071.004
18    - detection.emerging-threats
19logsource:
20    category: dns
21detection:
22    selection:
23        query|contains:
24            - 'katz-panel.com'
25            - 'katz-stealer.com'
26            - 'katzstealer.com'
27            - 'twist2katz.com'
28    condition: selection
29falsepositives:
30    - Unlikely
31level: high

References

Related rules

to-top