Detection rules › Sigma
DNS hosts file modified
Detects scenarios where an attacker attempts to modify the Hosts file to perform DNS interception and/or redirect network traffic.
Known false positives
- Administrator activity, web servers configuration, malware blocking attempt during incident response
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule body
title: DNS hosts file modified
description: Detects scenarios where an attacker attempts to modify the Hosts file to perform DNS interception and/or redirect network traffic.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0040-Impact/T1565-Data%20manipulation
- https://www.elastic.co/guide/en/security/current/hosts-file-modified.html
- https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/
tags:
- attack.impact
- attack.t1565
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 11
TargetFilename|endswith: '\System32\drivers\etc\hosts'
condition: selection
falsepositives:
- Administrator activity, web servers configuration, malware blocking attempt during incident response
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 11
TargetFilename|endswith: '\System32\drivers\etc\hosts'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with value:"\System32\drivers\etc\hosts" |