SUSP_Katz_Log_May25

rule SUSP_Katz_Log_May25 {
   meta:
      description = "Detects log file that contains system reconnaissance data, seen being generated by Katz stealer"
      author = "MalGamy"
      date = "2025-05-20"
      reference = "Internal Research"
      hash = "1ac196ac6393d786618c944a7ab77fb189a6b4ba00af5c0f987c3dc65876c060"
      hash = "ad76e2727469525dec7e56977589dd250ca57a29b8b0d42cd5c42e536c285241"
      hash = "e1a0d6929662bcbc9e5e0827cb8b6d7818088e996cf971d2a4a1c1ca4208e533"
      hash = "b10796c41e1cec7c84a3c68bfcaa7b20f49b620d1c94304a6b3ed73471fa9031"
      hash = "5a984e2e308fe84e4e2071dd877772361719ba0217c2c23da79dbb82dc15eac8"
      score = 65
      id = "be56f0ae-e444-569e-95d7-edccf4c6dd2b"
   strings:
      $s1 = "Motherboard Manufacturer:" ascii
      $s2 = "===== System Information =====" ascii
      $s3 = "Volume Name:" ascii
      $s4 = "Desktop Hostname:" ascii
   condition:
      filesize < 50KB
      and 3 of them
}