Update impact_hosts_file_modified.toml

Samirbous · web-flow · commit bc984c90ea0c · 2025-12-12T09:52:47.000Z
diff --git a/rules/cross-platform/impact_hosts_file_modified.toml b/rules/cross-platform/impact_hosts_file_modified.toml
@@ -106,7 +106,7 @@ any where process.executable != null and
   (
    event.category == "process" and event.type in ("start") and
      process.name in ("nano", "vim", "vi", "emacs", "echo", "sed") and
-     process.args : ("/etc/hosts") and 
+     (process.args : ("/etc/hosts") or (process.working_directory == "/etc" and process.args == "hosts")) and 
      not process.parent.name in ("dhclient-script", "google_set_hostname") and
      not process.command_line == "sed -i /Added by Google/d /etc/hosts"
   )

Original file line number	Diff line number	Diff line change
`@@ -106,7 +106,7 @@ any where process.executable != null and`
`106`	`106`	`(`
`107`	`107`	`event.category == "process" and event.type in ("start") and`
`108`	`108`	`process.name in ("nano", "vim", "vi", "emacs", "echo", "sed") and`
`109`		`- process.args : ("/etc/hosts") and`
	`109`	`+ (process.args : ("/etc/hosts") or (process.working_directory == "/etc" and process.args == "hosts")) and`
`110`	`110`	`not process.parent.name in ("dhclient-script", "google_set_hostname") and`
`111`	`111`	`not process.command_line == "sed -i /Added by Google/d /etc/hosts"`
`112`	`112`	`)`