alert http $HOME_NET any -> any any (msg:"ET MALWARE Katz Stealer User-Agent Observed (katz-ontop)"; flow:established,to_server; http.user_agent; content:"katz-ontop"; endswith; reference:url,www.nextron-systems.com/2025/05/23/katz-stealer-threat-analysis/; classtype:trojan-activity; sid:2062571; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2025_05_27, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, updated_at 2025_05_27; target:src_ip;)