Hosts-File - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/hosts-file/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 10:00:00 +0000Detection of Unauthorized Windows Hosts File Accesshttps://feed.craftedsignal.io/briefs/2024-01-03-hosts-file-access/Wed, 03 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-hosts-file-access/This analytic detects processes attempting to access the Windows hosts file, enabling attackers to redirect traffic to malicious sites or block legitimate security websites by modifying DNS resolution.This analytic focuses on detecting unauthorized attempts to access the Windows hosts file, a critical component for network configuration and DNS resolution. Attackers frequently target this file to manipulate DNS resolution, redirecting users to malicious websites, serving fake content, or blocking access to legitimate security resources. The detection mechanism relies on monitoring Windows Event Log Security (event code 4663) for file access events targeting the hosts file, typically located at C:\Windows\System32\drivers\etc\hosts. It excludes commonly used processes such as explorer.exe, lsass.exe, SearchIndexer.exe, services.exe, svchost.exe to reduce false positives. This detection is crucial because unauthorized modification of the hosts file can lead to severe security breaches, including phishing attacks and data theft.

Attack Chain

  1. An attacker gains initial access to the system through a vulnerability, compromised credentials, or social engineering. (T1189)
  2. The attacker elevates privileges to obtain the necessary permissions to modify the hosts file. (T1068)
  3. The attacker uses a script or tool to access the hosts file located at C:\Windows\System32\drivers\etc\hosts.
  4. The attacker modifies the hosts file to redirect legitimate domain names to malicious IP addresses controlled by the attacker. (T1012)
  5. When a user attempts to access a legitimate website, the modified hosts file redirects the request to the attacker's server.
  6. The attacker's server serves malicious content, such as a phishing page or malware, to the unsuspecting user.
  7. The user unknowingly provides sensitive information or downloads malware, leading to further compromise of the system.
  8. The attacker achieves their objective, which may include stealing credentials, gaining unauthorized access to sensitive data, or establishing a persistent foothold on the compromised system.

Impact

Successful modification of the hosts file allows attackers to redirect network traffic, leading to phishing attacks, malware distribution, and denial of service. Victims may unknowingly visit malicious websites, providing attackers with sensitive information like credentials or financial data. This attack can affect any user on the compromised system and can spread to other systems if the attacker uses the compromised system as a launching point. Depending on the level of access, the impact can range from individual data theft to widespread corporate network compromise.

Recommendation

  • Enable "Audit Object Access" in Group Policy and track event code 4663 in the Windows Security Event logs, as described in the "how_to_implement" section. This is critical for visibility into hosts file access attempts.
  • Deploy the Sigma rule "Detect Suspicious Hosts File Access" to your SIEM to identify unauthorized access attempts to the hosts file.
  • Investigate any alerts generated by the Sigma rule "Detect Suspicious Hosts File Access" and correlate with other security events to determine the scope and impact of the attack.
  • Periodically review and update the exclusion list in the Sigma rule "Detect Suspicious Hosts File Access" to account for legitimate software that may access the hosts file.
]]>highadvisoryhosts-filedns-redirectionwindows