Emerging Threathighexperimental

Katz Stealer Suspicious User-Agent

Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Swachchhanda Shrawan Poudel (Nextron Systems)Created Thu May 22834c6d2f-5e98-4b2a-b453-0c4f234afedd2025

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Zeek (Bro)http

ProductZeek (Bro)← raw: zeek

Servicehttp← raw: http

Detection Logic

detection:
    selection:
        user_agent|contains: 'katz-ontop'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

Sub-techniques

Other

detection.emerging-threats

Rule Metadata

Rule ID

834c6d2f-5e98-4b2a-b453-0c4f234afedd

Status

experimental

Level

high

Type

Emerging Threat

Created

Thu May 22

Author

Path

rules-emerging-threats/2025/Malware/Katz-Stealer/zeek_http_katz_stealer_susp_useragent.yml

Raw Tags

attack.command-and-controlattack.t1071.001detection.emerging-threats