Windows Image Load of Katz Stealer DLLs

Alerts on Windows image loads of DLLs with Katz Stealer-associated names/paths.

FreeUnreviewedSigmahighv1

windows-image-load-of-katz-stealer-dlls-e6c7ab7c

title: Windows Image Load of Katz Stealer DLLs
id: ce2b5a7b-b33c-4750-be80-f0f53acf0fe8
status: experimental
description: This rule flags Windows process activity where a loaded image matches specific DLL paths associated with Katz Stealer 2025 variants. Loading these DLLs is a strong indicator of malicious execution because attackers commonly stage and load stealers’ libraries from user temp locations or embedded filenames. The detection relies on image-load telemetry that provides the fully qualified path of the DLL being loaded.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Katz-Stealer/image_load_win_katz_stealer_payloads.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
  - attack.execution
  - attack.t1129
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \katz_ontop.dll
      - \AppData\Local\Temp\received_dll.dll
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e6c7ab7c-c79d-4b84-b913-b2ec3f8e8a98
    type: derived

What it detects

This rule flags Windows process activity where a loaded image matches specific DLL paths associated with Katz Stealer 2025 variants. Loading these DLLs is a strong indicator of malicious execution because attackers commonly stage and load stealers’ libraries from user temp locations or embedded filenames. The detection relies on image-load telemetry that provides the fully qualified path of the DLL being loaded.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.