Windows Hosts File Modification

Description

The search looks for modifications to the hosts file on all Windows endpoints across your environment.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Advanced Threat Detection

Category

Endpoint Compromise

Alert Volume

The search looks for modifications to the hosts file on all Windows endpoints across your environment.

SPL Difficulty

None

Journey

Stage 3

Kill Chain Phases

Command and Control

Data Sources

Endpoint Detection and Response

   Help

Windows Hosts File Modification Help

To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.

   Search

Open in Search