Sigma-to-MDE Query Conversion: DNS Detection for Katz Stealer via Uncoder AI

Unlock the Secrets of Ethical Hacking!

Ready to dive into the world of offensive security? This course gives you the Black Hat hacker’s perspective, teaching you attack techniques to defend against malicious activity. Learn to hack Android and Windows systems, create undetectable malware and ransomware, and even master spoofing techniques. Start your first hack in just one hour!

Enroll now and gain industry-standard knowledge: Enroll Now!

How It Works

Uncoder AI reads a Sigma detection rule designed to identify DNS queries to malicious domains linked with the Katz Stealer malware family. It then automatically rewrites the logic into a fully compatible Microsoft Defender for Endpoint (MDE) Advanced Hunting query using the Kusto Query Language (KQL).

Left Panel – Sigma Rule:

The rule is tagged with MITRE ATT&CK techniques like T1071.004 (Command and Control over DNS).
It detects DNS queries to domains such as katz-panel.com, katzstealer.com, and related C2 infrastructure.
It uses the dns_query category under windows logs.

Explore Uncoder AI

Right Panel – MDE Query:

Uncoder AI outputs a structured MDE query that:

Filters DNS inspection events (ActionType=="DnsConnectionInspected")
Dynamically extracts the domain name from json.query using todynamic() and tostring()
Matches domain names against the known IOC list using the contains operator

Example query excerpt:

DeviceNetworkEvents

|where ActionType=='DnsConnectionInspected'

|extend RemoteUrl=tostring(json.query)

|where RemoteUrl contains@"katz-panel.com" …

This query is ready to be used in Microsoft 365 Defender’s Advanced Hunting module for real-time or retroactive detection.

Why It’s Innovative

Translating detection rules across platforms is a major challenge, especially when adapting:

Sigma’s abstracted field names to vendor-specific telemetry structures
Query syntax for different environments (e.g., from YAML logic to KQL for MDE)
Domain-based detection into structured JSON-aware logic

Uncoder AI automates this with precision by:

Parsing Sigma’s selection logic
Mapping detection fields to Microsoft Defender schema
Maintaining intent, indicators, and logic across formats

Rule/Query Full Summary

Operational Value

With this feature, detection engineers can:

Deploy Sigma rules directly into Microsoft Defender environments without writing KQL from scratch
Detect threats like Katz Stealer across enterprise DNS telemetry
Accelerate detection engineering cycles
Ensure syntax validity and semantic correctness across translations

This capability dramatically improves the reuse and portability of threat detection content in modern SOC workflows.

Explore Uncoder AI

The post Sigma-to-MDE Query Conversion: DNS Detection for Katz Stealer via Uncoder AI appeared first on SOC Prime.

Unlock the Secrets of Ethical Hacking!