feat(rules): Suspicious access to the hosts file

Identifies suspicious process accessing the Windows hosts file for potential tampering. Adversaries can hijack the hosts files to block traffic to download/update servers or redirect the traffic to arbitrary servers under their control.

Author: rabbitstack

rules/defense_evasion_suspicious_access_to_the_hosts_file.yml

@@ -0,0 +1,37 @@
+name: Suspicious access to the hosts file
+id: f7b2c9d3-99e7-41d5-bb4a-6ea1a5f7f9e2
+version: 1.0.0
+description: >
+  Identifies suspicious process accessing the Windows hosts file for potential tampering.
+  Adversaries can hijack the hosts files to block traffic to download/update servers or redirect the
+  traffic to arbitrary servers under their control.
+labels:
+  tactic.id: TA0005
+  tactic.name: Defense Evasion
+  tactic.ref: https://attack.mitre.org/tactics/TA0005/
+  technique.id: T1562.001
+  technique.name: Impair Defenses - Disable or Modify Tools
+  technique.ref: https://attack.mitre.org/techniques/T1562/001/
+references:
+  - https://www.malwarebytes.com/blog/news/2016/09/hosts-file-hijacks
+
+condition: >
+  sequence
+  maxspan 5m
+    |spawn_process and not ps.child.exe imatches 
+      (
+        '?:\\Windows\\servicing\\TrustedInstaller.exe',
+        '?:\\Windows\\System32\\svchost.exe',
+        '?:\\Windows\\System32\\MicrosoftEdgeUpdate.exe',
+        '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'
+      )
+    | by ps.child.uuid
+    |open_file and file.path imatches '?:\\Windows\\System32\\drivers\\etc\\hosts'| by ps.uuid
+action:
+  - name: kill
+
+output: >
+  Suspicious process %1.ps.child.exe accessed the hosts file for potential tampering
+severity: medium
+
+min-engine-version: 2.2.0