Zeek HTTP: Suspicious User-Agent Containing "katz-ontop"

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags Zeek-observed HTTP connections where the User-Agent header contains the string "katz-ontop". A distinctive User-Agent like this can help attackers blend into web traffic while running malware communications. Detection relies on Zeek HTTP telemetry that records the User-Agent associated with outbound or inbound HTTP requests.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Zeek HTTP: Suspicious User-Agent Containing "katz-ontop"

Pivot detection · T1071.001 · 9 related

Changelog

v5

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

zeek-http-connections-with-suspicious-user-agent-containing-katz-ontop-834c6d2f

title: 'Zeek HTTP: Suspicious User-Agent Containing "katz-ontop"'
id: 7d588f47-ef23-4cb8-a666-9ff52c6558c6
status: experimental
description: This rule flags Zeek-observed HTTP connections where the User-Agent header contains the string "katz-ontop". A distinctive User-Agent like this can help attackers blend into web traffic while running malware communications. Detection relies on Zeek HTTP telemetry that records the User-Agent associated with outbound or inbound HTTP requests.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Katz-Stealer/zeek_http_katz_stealer_susp_useragent.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-22
tags:
  - attack.command-and-control
  - attack.t1071.001
  - detection.emerging-threats
logsource:
  product: zeek
  service: http
detection:
  selection:
    user_agent|contains: katz-ontop
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 834c6d2f-5e98-4b2a-b453-0c4f234afedd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL