Mac hosts files can't be persisted always been overwritten

Question

Any change I made to /private/etc/hosts file can't be persisted. After a while(like 10 minitues), the file will be overwritten. How can I find out the root cause of this problem? Or can I make the file immutable like using chattr under Linux?

No suspicious software(like cisco VPN) is installed. No strange file exists(like /etc/hosts.ac). I do have installed some VPN software like tunnelblick and pulse secure.

Answer 1

It turns out to be same problem with VPN software on this link

In my situation, it's /etc/pulse-hosts.bak. I suggest use ls -lha /etc/*hosts* to list all suspicious files so you can't miss anyone.

Tools to trace file modification:sudo opensnoop 2>/dev/null | grep hosts

Tools to disable change to hosts file(in case you can't find any clue): sudo chflags schg /etc/hosts