huntrule

Windows DNS Queries to Known Katz Stealer Domains

Alerts on Windows DNS queries to domains associated with Katz Stealer malware infrastructure.

FreeUnreviewedSigmahighv1
title: Windows DNS Queries to Known Katz Stealer Domains
id: 3534301e-89fa-4496-af92-d04843e4103e
related:
  - id: 6b0c762f-0e1b-435f-a829-5943b08fe36a
    type: similar
  - id: 9c3d6e32-f4c8-4d73-8b8f-95c3b383a13c
    type: derived
status: experimental
description: This rule flags Windows DNS query events where the queried domain name contains Katz Stealer-related domains (including katz-panel.com, katz-stealer.com, katzstealer.com, and twist2katz.com). Malicious loaders and malware frequently rely on DNS for command-and-control or payload retrieval, so hitting attacker-controlled domains is a strong indicator of potential compromise. It relies on DNS query telemetry that includes the QueryName observed on the host making the DNS request.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Katz-Stealer/dns_query_win_katz_stealer_domain.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
  - attack.command-and-control
  - attack.t1071.004
  - detection.emerging-threats
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains:
      - katz-panel.com
      - katz-stealer.com
      - katzstealer.com
      - twist2katz.com
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags Windows DNS query events where the queried domain name contains Katz Stealer-related domains (including katz-panel.com, katz-stealer.com, katzstealer.com, and twist2katz.com). Malicious loaders and malware frequently rely on DNS for command-and-control or payload retrieval, so hitting attacker-controlled domains is a strong indicator of potential compromise. It relies on DNS query telemetry that includes the QueryName observed on the host making the DNS request.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.