Detects .NET based Katz stealer loader

Hunt Hypothesis

This rule detects the execution of a .NET-based Katz stealer loader, indicating an adversary’s initial foothold aimed at harvesting sensitive credentials and data from compromised endpoints. A proactive hunt is essential in Azure Sentinel to identify early-stage infections before the stealer exfiltrates critical information, thereby preventing lateral movement and broader network compromise.

YARA Rule

rule MAL_NET_Katz_Stealer_Loader_May25 {
   meta:
      description = "Detects .NET based Katz stealer loader"
      author = "Jonathan Peters (cod3nym)"
      date = "2025-05-21"
      reference = "Internal Research"
      hash = "0df13fd42fb4a4374981474ea87895a3830eddcc7f3bd494e76acd604c4004f7"
      score = 80
      id = "c3d33818-66a1-51d9-9bcd-d8d255f96881"
   strings:
      $x = "ExecutarMetodoVAI" ascii

      $s1 = "VirtualMachineDetector" ascii
      $s2 = "Wow64SetThreadContext_API" ascii
      $s3 = "nomedoarquivo" ascii
      $s4 = { 65 78 74 65 6E C3 A7 61 6F 00 }
      $s5 = "payloadBuffer" ascii
      $s6 = "caminhovbs" ascii
   condition:
      3 of ($s*) or $x
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects .NET based Katz stealer loader rule, including suggested filters and exclusions:

• Scenario: Legitimate deployment of Microsoft Teams or Office 365 updates via the .NET runtime.

  • Context: The Teams.exe or OfficeClickToRun.exe processes often spawn child .NET processes (e.g., Microsoft.Teams.Apps.Updater) that load managed assemblies to handle configuration changes, mimicking the behavior of a Katz loader.
  • Filter/Exclusion: Create an exclusion based on the parent process name (Teams.exe, OfficeClickToRun.exe) and the specific file path (e.g., C:\Users\*\AppData\Local\Microsoft\Teams\current\... or C:\Program Files\Microsoft Office root\...).

• Scenario: Execution of a scheduled PowerShell job for inventory management using .NET assemblies.

  • Context: IT operations often run nightly scripts via Task Scheduler (e.g., InventorySync.ps1) that load custom .NET libraries to query hardware or software assets. These scripts frequently utilize the System.Management namespace, triggering the detection logic.
  • Filter/Exclusion: Exclude events where the parent process is svchost.exe with a specific service name (e.g., TaskScheduler) and the command line contains keywords like -Command, -File, or specific internal script paths (e.g., \\fileserver\scripts\).

• Scenario: Internal DevOps pipeline agent running .NET-based build tools.

  • Context: CI/CD agents (such as Jenkins, GitLab Runner, or Azure DevOps agents) frequently execute .NET applications to compile code or run unit tests. These agents often load the Katz library (or similar reflection-based loaders)