Detection of Unauthorized Hosts File Modifications

Modifying the hosts file is a persistent technique used by attackers to gain control over local hostname resolution. By acting as the first point of lookup before external DNS, a compromised hosts file allows adversaries to reroute legitimate traffic to malicious IP addresses. This technique has been observed in the wild where actors targeted domain controllers to intercept and redirect multi-factor authentication (MFA) requests. By pointing MFA validation traffic to localhost, attackers can trigger security "fail open" conditions, effectively disabling MFA for active domain accounts. This impact extends across Windows, Linux, and macOS environments, making it a critical area for detection engineering to monitor, particularly where security services rely on clear network paths to reach authentication providers.

Impact

Successful manipulation of the hosts file can lead to the silent redirection of sensitive organizational traffic, resulting in credential harvesting, man-in-the-middle attacks, or the bypass of critical security controls like MFA. Impact is high in environments where security policies default to "fail open" states when authentication services are unreachable.

Recommendation

• Implement file integrity monitoring on the hosts file path across all supported operating systems.
• Deploy the Sigma rules below to monitor for unauthorized modifications to the hosts file.
• Review and tune the exclusion list for benign management tools (e.g., configuration management agents, local service scanners) to minimize noise.
• Investigate the parent process tree for any process found modifying the hosts file to determine the initial access vector.