Suspicious Modification Of Hosts File

Query

let Lookback = 30d;
let ExcludedProcesses = dynamic(["vpnagent.exe", "myfunnyDummyBeerProxess.exe"]);
let HostsPath = @"C:\Windows\System32\drivers\etc\";
let HostsEvents = materialize(
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where FileName =~ "hosts"
    | where FolderPath has HostsPath
    | where ActionType in~ ("FileCreated", "FileModified")
    | where InitiatingProcessFileName !in~ (ExcludedProcesses)
    | project Timestamp, DeviceId, DeviceName, FileName, FolderPath, ActionType, SHA256, InitiatingProcessFileName, InitiatingProcessAccountName
);
let SuspiciousHashes = HostsEvents
| distinct SHA256
| invoke FileProfile(SHA256)
| where GlobalFirstSeen > ago(90d) and GlobalPrevalence < 1000
| project SHA256;
HostsEvents
| where SHA256 in~ (SuspiciousHashes)

About this query

Suspicious Modification of Hosts File

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1565.001	Data Manipulation: Stored Data Manipulation	https://attack.mitre.org/techniques/T565/001
T1071.001	Application Layer Protocol: Web Protocols	https://attack.mitre.org/techniques/T1071/001

Description

This rule detects modifications to the Windows hosts file by processes that are not in the approved exclusion list. It further refines the detection by filtering for hosts file hashes with low global prevalence or recent appearance in the environment, which is indicative of potential malicious activity like DNS hijacking or malware redirection.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

Defender XDR

Explanation

This query is designed to detect suspicious changes to the Windows hosts file, which is a common target for malicious activities like DNS hijacking or malware redirection. Here's a simplified breakdown of what the query does:

Time Frame: It looks back over the last 30 days for any relevant events.
Excluded Processes: It ignores changes made by certain known processes (vpnagent.exe and myfunnyDummyBeerProxess.exe), assuming these are legitimate and not suspicious.
Hosts File Location: It specifically monitors the hosts file located in the C:\Windows\System32\drivers\etc\ directory.
File Events: It captures events where the hosts file was created or modified, but only if the process that initiated the change is not in the exclusion list.
Suspicious Hashes: It identifies file hashes (unique identifiers for file versions) of the hosts file that are either new (seen globally for the first time within the last 90 days) or rare (seen in less than 1000 instances globally).
Final Output: The query outputs details of any hosts file modifications that match the suspicious hashes criteria, indicating potential malicious activity.

In essence, this query helps identify unauthorized or unusual modifications to the hosts file, which could be a sign of an attack or malware presence.