Detects Katz stealer

Hunt Hypothesis

This detection rule identifies the execution of Katz stealer, a threat capable of harvesting sensitive credentials and session tokens from memory to facilitate lateral movement and data exfiltration. A proactive hunt is essential in Azure Sentinel because Katz often operates with low visibility during its initial infection phase, requiring early intervention to prevent widespread compromise before the adversary establishes persistence or escalates privileges.

YARA Rule

rule MAL_Katz_Stealer_May25 {
   meta:
      description = "Detects Katz stealer"
      author = "MalGamy (Nextron Systems)"
      date = "2025-05-16"
      reference = "Internal Research"
      hash = "fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789"
      hash = "d92bb6e47cb0a0bdbb51403528ccfe643a9329476af53b5a729f04a4d2139647"
      score = 80
      id = "ef84df99-3c1a-56b6-a0fd-39876982d0c3"
   strings:
      $s1 = "Motherboard Product: %s" ascii
      $s2 = "cmd.exe /c %s" ascii
      $s3 = "reg export \"%s\" \"%s\" /y" ascii
      $s4 = ").request({ hostname: '" ascii
      $s5 = "Type: Removable"
      $s6 = "%s\\Microsoft\\Windows Live Mail" ascii
   condition:
      uint16(0) == 0x5a4d
      and filesize < 300KB
      and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects Katz Stealer rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Credential Dumping by Enterprise Password Managers

  • Context: Tools like CyberArk Endpoint Privilege Manager, BeyondTrust Endpoint Privilege Manager, or Microsoft Authenticator often perform background credential scanning to sync vaults. These tools utilize memory scraping techniques that mimic the behavior of Katz Stealer (specifically accessing lsass.exe and reading token structures).
  • Filter/Exclusion: Create an exclusion based on the Process Name (CyberArkAgent.exe, BeyondTrustClient.exe) AND Parent Process matching the known installer service. Additionally, filter out events where the MD5 hash of the executable matches a trusted baseline stored in your asset inventory.

• Scenario: Scheduled Admin Tasks for Security Compliance Audits

  • Context: Internal security teams often run scheduled PowerShell scripts or Sysmon custom collectors during off-hours to audit local administrator accounts and token permissions. These scripts frequently invoke whoami /all or interact with the Local Security Authority Subsystem Service (LSASS), triggering memory access alerts similar to Katz Stealer’s initial infection phase.
  • Filter/Exclusion: Exclude events occurring within a specific Time Window (e.g., 02:00–04:00 UTC) where the User Account is a dedicated service account (e.g., svc-audit-runner) and the Command Line contains keywords like “compliance-scan” or “token-audit”.

• Scenario: Endpoint Detection and Response (EDR) Self-Scanning

  • Context: EDR agents such as CrowdStrike Falcon, SentinelOne, or **Microsoft Defender for