Evidence: ETC Hosts
Description: Collect ETC Hosts
Category: Network
Platform: macos
Short Name: etch
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
This collector gathers hosts file entries from macOS. This data is essential for understanding static hostname mappings, detecting malicious overrides, and investigating network resolution issues.
Data Collected
This collector gathers structured data about etc hosts.
Collection Method
This collector queries osquery’s etc_hosts table and records rows into the etc_hosts table.
Forensic Value
This evidence is crucial for forensic investigations as it reveals local DNS overrides that can indicate redirection, exfiltration paths, or misconfigurations.
