huntrule

Zeek HTTP Connections with Suspicious User-Agent Containing Katz-ontop

Alerts on Zeek HTTP sessions whose User-Agent includes "katz-ontop", a potential malware indicator.

FreeUnreviewedSigmahighv1
title: Zeek HTTP Connections with Suspicious User-Agent Containing Katz-ontop
id: 7d588f47-ef23-4cb8-a666-9ff52c6558c6
status: experimental
description: This rule flags Zeek-recorded HTTP network connections where the User-Agent header contains the string "katz-ontop". Such a distinctive User-Agent can be used by malware for identifying or communicating with infrastructure, making it a useful indicator for suspicious command-and-control behavior. Detection relies on Zeek HTTP telemetry capturing the User-Agent field from outbound or inbound HTTP requests.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Katz-Stealer/zeek_http_katz_stealer_susp_useragent.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
  - attack.command-and-control
  - attack.t1071.001
  - detection.emerging-threats
logsource:
  product: zeek
  service: http
detection:
  selection:
    user_agent|contains: katz-ontop
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 834c6d2f-5e98-4b2a-b453-0c4f234afedd
    type: derived

What it detects

This rule flags Zeek-recorded HTTP network connections where the User-Agent header contains the string "katz-ontop". Such a distinctive User-Agent can be used by malware for identifying or communicating with infrastructure, making it a useful indicator for suspicious command-and-control behavior. Detection relies on Zeek HTTP telemetry capturing the User-Agent field from outbound or inbound HTTP requests.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.