huntrule

DNS Queries to Katz Stealer–Associated Domains

Alerts on DNS queries for domains associated with Katz Stealer.

FreeUnreviewedSigmahighv1
title: DNS Queries to Katz Stealer–Associated Domains
id: 06784aa8-bb45-445a-8dcd-70a06d990fdf
related:
  - id: 9c3d6e32-f4c8-4d73-8b8f-95c3b383a13c
    type: similar
  - id: 6b0c762f-0e1b-435f-a829-5943b08fe36a
    type: derived
status: experimental
description: This rule flags DNS queries whose queried domain contains Katz Stealer–associated domains (katz-panel.com, katz-stealer.com, katzstealer.com, or twist2katz.com). Such lookups may indicate command-and-control or staging activity tied to malware attempting to reach attacker-controlled infrastructure. It relies on DNS telemetry that includes the queried domain name and matches on substring containment.
references:
  - Internal research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Katz-Stealer/net_dns_katz_stealer_domain.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
  - attack.command-and-control
  - attack.t1071.004
  - detection.emerging-threats
logsource:
  category: dns
detection:
  selection:
    query|contains:
      - katz-panel.com
      - katz-stealer.com
      - katzstealer.com
      - twist2katz.com
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags DNS queries whose queried domain contains Katz Stealer–associated domains (katz-panel.com, katz-stealer.com, katzstealer.com, or twist2katz.com). Such lookups may indicate command-and-control or staging activity tied to malware attempting to reach attacker-controlled infrastructure. It relies on DNS telemetry that includes the queried domain name and matches on substring containment.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.