Etc Hosts

Overview

Evidence: ETC Hosts Description: Collect ETC Hosts Category: Network Platform: macos Short Name: etch Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

This collector gathers hosts file entries from macOS. This data is essential for understanding static hostname mappings, detecting malicious overrides, and investigating network resolution issues.

Data Collected

This collector gathers structured data about etc hosts.

Collection Method

This collector queries osquery’s etc_hosts table and records rows into the etc_hosts table.

Forensic Value

This evidence is crucial for forensic investigations as it reveals local DNS overrides that can indicate redirection, exfiltration paths, or misconfigurations.