Hosts file modified by non-system process to sinkhole AV and telemetry domains
Detects modifications to the Windows hosts file by non-system user-space processes, particularly correlating with prior execution of suspicious or user-profile/temp-located executables such as rockstargames.exe.
Splunk (SPL)
