Suspicious access to the hosts file
Identifies suspicious process accessing the Windows hosts file for potential tampering. Adversaries can hijack the hosts files to block traffic to download/update servers or redirect the traffic to arbitrary servers under their control.
- Platform: Windows
- Severity: Medium
- MITRE Tactic: Defense Evasion
- MITRE Techniques: T1562.001