Who changed the host file on the DCs?
DeviceFileEvents
| where FileName == @"hosts"
| where FolderPath == @"C:\Windows\System32\drivers\etc\hosts"
| where ActionType in ("FileModified", "FileRenamed")
| extend Initiator = tostring(InitiatingProcessFileName),
InitiatorCmd = tostring(InitiatingProcessCommandLine),
InitiatorHash = tostring(SHA256),
FolderDepth = array_length(split(FolderPath, @"\"))
| summarize
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp),
Count = count(),
UniqueDevices = dcount(DeviceName),
UniqueUsers = dcount(InitiatingProcessAccountName)
by Initiator, InitiatorCmd, InitiatorHash, DeviceName, FileName, InitiatingProcessAccountName, ReportId
| order by LastSeen desc