Monitor Hosts File
Query
// Use Case: The hosts file located at C:\Windows\System32\drivers\etc\hosts is utilized for DNS resolution. Alterations made to this file have the capability to reroute network traffic or prevent software updates from occurring.
FileInfo('c:\windows\system32\drivers\etc\hosts')
| project Path, FileName, SizeBytes, LastModifiedDateTime, AttributesExplanation
This KQL query is designed to retrieve information about the "hosts" file located at "C:\Windows\System32\drivers\etc\hosts" on a Windows system. The "hosts" file is important because it can be used to control DNS resolution, which means it can redirect network traffic or block software updates if altered.
The query specifically extracts and displays the following details about the "hosts" file:
- Path: The location of the file on the system.
- FileName: The name of the file.
- SizeBytes: The size of the file in bytes.
- LastModifiedDateTime: The date and time when the file was last modified.
- Attributes: The file attributes, which may include information like whether the file is read-only, hidden, or a system file.
In simple terms, this query helps you monitor and check the status of the "hosts" file to ensure it hasn't been tampered with, which could affect network operations or software updates.
Details
Ugur Koc
Released: December 13, 2024
Tables
FileInfo
Keywords
FileInfoPathFileNameSizeBytesLastModifiedDateTimeAttributes
Operators
FileInfoproject