EDR: Why is the hosts file being modified when using legacy certificates?

[#1]

Environment

• EDR Windows sensor: 7.4.1
• Microsoft Windows: All Supported Versions

Question

• cb.exe is modifying the C:\Windows\System32\drivers\etc\hosts file
• This is true regardless of legacy or custom certificates being used

Answer

With the IPV6 support added with the 7.4 EDR Windows sensor release, the sensor will now modify the hosts file whether custom or legacy certificates are used.

Additional Notes

If this should change, customer feedback is needed. Please submit this change request via Voice of the Customer

Related Content

EDR: Is the cb.exe process supposed to update the hosts file on a Windows OS endpoint?
EDR: Why does the Windows Sensor Modify Hosts file?