Attackers modify system binaries, web shells appear in upload directories, and ransomware changes file extensions. Without file integrity monitoring (FIM), these changes go unnoticed for months. This lesson covers deploying and managing FIM across platforms with AIDE, Tripwire, and Windows SFC/File Integrity Monitoring—so you'll catch tampering before it becomes a headline.
FIM tools create a cryptographic baseline of file attributes (checksums, permissions, timestamps) for a set of monitored paths. On a schedule or on-demand, they re-scan and compare against the baseline, reporting any additions, deletions, or modifications. To avoid false positives, FIM databases must be updated after planned changes. The key is to store the baseline database and configuration on read-only media or offline to prevent tampering.
# Install and initialize AIDE on Linux
sudo apt install aide
sudo aideinit
# The database is created at /var/lib/aide/aide.db.new
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
# Run a check
sudo aide -c /etc/aide/aide.conf --checkThe initial aideinit builds the baseline. Moving the new database into place is crucial; otherwise, the next check will report everything as changed. Run periodically via cron and pipe output to a SIEM.
Windows includes SFC (System File Checker) to verify integrity of protected system files. For broader FIM, use the built-in file auditing (SACL) and event logs (Event ID 4663 for object access), or deploy Microsoft Defender for Endpoint's custom file integrity monitoring. SFC /scannow repairs corrupted files from the component store, but it won't detect a custom backdoor named notepad.exe placed in a user's profile. For that, you need a SACL that audits writes.
💡 SFC only checks files protected by Windows Resource Protection. To monitor user-writable areas, configure SACLs and collect Event 4663 in your SIEM.
| Tool | Platform | Key Feature |
|---|---|---|
| AIDE | Linux/macOS | Advanced rule sets, database can be offloaded |
| Tripwire | Linux/Windows | Enterprise-grade, policy-based, commercial |
| Windows SACL + Event 4663 | Windows | Native auditing, integrates with SIEM |
| Microsoft Defender FIM | Windows | Cloud-managed, part of MDE suite |
Raw FIM logs are noisy. Tuning means excluding directories where legitimate changes happen frequently (log files, temp folders) and focusing on critical binaries, config files, and web roots. Define a response playbook: when a critical file change is detected, isolate the host, capture a forensic snapshot, and investigate the process that made the change. Without a playbook, alerts become ignored noise.
⚠️ If an attacker gains root, they can modify the FIM database itself. Use an agent that ships events off-box in real-time and store the database on immutable storage.
Verify exercises to earn ★ 150 XP and unlock next lab level.