Etc Hosts

Overview

Evidence: ETC Hosts Description: Collect ETC Hosts Category: Configurations Platform: macOS Short Name: etch Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

This collector gathers hosts file entries from macOS. This data is essential for understanding static hostname mappings, detecting malicious overrides, and investigating network resolution issues.

Data Collected

This collector gathers structured data about etc hosts.

ETC Hosts Data

Field	Description	Example
ID	ID	1
Address	Address	Example value
HostNames	Host Names	Example Name

Collection Method

This collector queries osquery’s etc_hosts table and records rows into the etc_hosts table.

Usage

This evidence is crucial for forensic investigations as it reveals local DNS overrides that can indicate redirection, exfiltration paths, or misconfigurations.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.