Katz Stealer Suspicious C2 Connections

R W@shiftyroot

•updated Jul 24, 2025•3•1•52

This rule identifies network traffic to known Command and Control (C2) infrastructure associated with the Katz Stealer malware family. It uses a list of hardcoded IP addresses and domains from threat intelligence to detect suspicious outbound connections.