detection.wiki

Detection rules › Sigma

DNS hosts file modified

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to modify the Hosts file to perform DNS interception and/or redirect network traffic.

MITRE ATT&CK coverage

TacticTechniques
ImpactT1565 Data Manipulation

Rule body yaml

title: DNS hosts file modified
description: Detects scenarios where an attacker attempts to modify the Hosts file to perform DNS interception and/or redirect network traffic.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0040-Impact/T1565-Data%20manipulation
- https://www.elastic.co/guide/en/security/current/hosts-file-modified.html
- https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/
tags:
- attack.impact
- attack.t1565
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 11
    TargetFilename|endswith: '\System32\drivers\etc\hosts'
  condition: selection
falsepositives:
- Administrator activity, web servers configuration, malware blocking attempt during incident response
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 11
  TargetFilename|endswith: '\System32\drivers\etc\hosts'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • \System32\drivers\etc\hosts