Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    Rule Library

    Sigma Rules

    Browse detections by severity and log source, with YAML and sample events one click away.

    3,782Total
    3,164Detection
    474Emerging
    141Hunting
    4 rulesInspect a rule without leaving your results.
    highexperimentalEmerging Threat

    DNS Query To Katz Stealer Domains

    Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

    windowsdns_query
    2025-05-22
    highexperimentalEmerging Threat

    Katz Stealer DLL Loaded

    Detects loading of DLLs associated with Katz Stealer malware 2025 variants. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. The process that loads these DLLs are very likely to be malicious.

    windowsimage_load
    2025-05-22
    highexperimentalEmerging Threat

    DNS Query To Katz Stealer Domains - Network

    Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

    Generaldns
    2025-05-22
    highexperimentalEmerging Threat

    Katz Stealer Suspicious User-Agent

    Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.

    zeekhttp
    2025-05-22