Detection rules › Sigma

DNS hosts file accessed via network share

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempt read the Hosts file content via network share.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1018 Remote System Discovery

Event coverage

Rule body yaml

title: DNS hosts file accessed via network share
description: Detects scenarios where an attacker attempt read the Hosts file content via network share.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1018-Remote%20System%20Discovery
- https://www.picussecurity.com/resource/blog/how-to-beat-nefilim-ransomware-attacks
- https://github.com/login-securite/DonPAPI
tags:
- attack.discovery
- attack.t1018
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\C$'
    RelativeTargetName: 'Windows\System32\Drivers\etc\hosts'
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 5145
  ShareName: '\\*\C$'
  RelativeTargetName: 'Windows\System32\Drivers\etc\hosts'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
RelativeTargetNameeq
  • Windows\System32\Drivers\etc\hosts
ShareNamewildcard
  • \\*\C$ corpus 7 (sigma 7)