Windows DLL Load Indicators for Katz Stealer 2025 Variants
Alerts on Windows image loads of DLLs with Katz Stealer-associated names/paths.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- image_load
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-05-22
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows processes that load specific DLLs associated with Katz Stealer malware 2025 variants. Loading these DLL paths strongly indicates malicious behavior because the DLL names and locations are consistent with staged malware components. The detection relies on image-load telemetry that records the DLL path when it is loaded by a process.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-image-load-of-katz-stealer-dlls-e6c7ab7c
title: Windows DLL Load Indicators for Katz Stealer 2025 Variants
id: ce2b5a7b-b33c-4750-be80-f0f53acf0fe8
status: experimental
description: This rule identifies Windows processes that load specific DLLs associated with Katz Stealer malware 2025 variants. Loading these DLL paths strongly indicates malicious behavior because the DLL names and locations are consistent with staged malware components. The detection relies on image-load telemetry that records the DLL path when it is loaded by a process.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Katz-Stealer/image_load_win_katz_stealer_payloads.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
- attack.execution
- attack.t1129
- detection.emerging-threats
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith:
- \katz_ontop.dll
- \AppData\Local\Temp\received_dll.dll
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: e6c7ab7c-c79d-4b84-b913-b2ec3f8e8a98
type: derived