Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 00:49:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 106

Update etc_hosts.yml (#19517)

Browse source 
Updates to etc_hosts per #16993

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
This commit is contained in:
Brock Walters 2024-06-05 11:14:06 -04:00 committed by GitHub
parent 80a9ffeb69
commit 1045136cb1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 14 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
schema/tables/etc_hosts.yml
View file

@ -1,12 +1,22 @@
name: etc_hosts
description: The `hosts` file comprises a local, plain-text configuration for mapping IP addresses to host names. It does not necessarily rely on an external Domain Name System (DNS) for routing. The `etc_hosts` osquery table expresses the data in the `hosts` file.
examples: |-
Identify host"name"s pointed to IP addresses using the hosts file. This
technique is often abused by malware, but can also indicate services that do
not have proper DNS configuration to be reached from workstations.
This query detects if the macOS `/private/etc/hosts` file has been modified from its default state:
```
SELECT * FROM etc_hosts WHERE address!='127.0.0.1' AND address!='::1' AND address!='255.255.255.255';
SELECT * FROM etc_hosts WHERE address != '127.0.0.1' AND address != '::1' AND address != '255.255.255.255';
```
notes: |-
The `hosts` file is customized by many organizations. As part of a defense-in-depth security posture it's important to track `hosts` modifications. Endpoints with a modified `hosts` configuration connected to enterprise networks can potentially bypass network rules, proxies and firewalls or be routed to malicious sites.
File paths:
Linux: /etc/hosts
macOS: /private/etc/hosts
Windows: C:\Windows\system32\drivers\etc
- [DNS](https://en.wikipedia.org/wiki/Domain_Name_System)
- The `/etc/hosts` [Guide For Linux](https://thelinuxcode.com/etc-hosts-file-complete-guide-for-linux/)
- [How to edit the hosts file on Windows](https://www.howtogeek.com/784196/how-to-edit-the-hosts-file-on-windows-10-or-11)
columns:
- name: pid_with_namespace
platforms: