BIOC
Informational
✕
Windows hosts file written to
Check for hosts file redirection, overriding the system's default hosts file to manipulate DNS.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Collection
- Status:
- Enabled
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Data from Information Repositories (T1213)
Indicator:
File file name = hosts AND file path = *:\Windows\System32\drivers\etc\* AND action type = write
Preventable: yes