ETC Hosts
Overview
Section titled “Overview”Evidence: ETC Hosts
Description: Collect ETC Hosts
Category: Network
Platform: macos
Short Name: etch
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”This collector gathers hosts file entries from macOS. This data is essential for understanding static hostname mappings, detecting malicious overrides, and investigating network resolution issues.
Data Collected
Section titled “Data Collected”This collector gathers structured data about etc hosts.
Collection Method
Section titled “Collection Method”This collector queries osquery’s etc_hosts table and records rows into the etc_hosts table.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as it reveals local DNS overrides that can indicate redirection, exfiltration paths, or misconfigurations.