MISSION LAB

File Integrity Monitoring

< Shield House

MISSION OBJECTIVES

0/8 Complete

    FILE INTEGRITY INTEL

    MISSION BRIEFING

    After a suspected breach, your IR team needs to verify which files were modified. Set up AIDE (Advanced Intrusion Detection Environment), create baselines, and identify tampered files before the forensic window closes.

    Integrity Commands

    sha256sum file
    Generate SHA-256 hash of a file
    sha256sum -c checksums.txt
    Verify files against saved checksums
    aide --init
    Initialize AIDE database
    aide --check
    Check files against AIDE database
    aide --update
    Update AIDE database after changes
    cat /etc/aide/aide.conf
    View AIDE configuration
    md5sum file
    MD5 hash (weaker, use SHA-256)
    Why This Matters
    File integrity monitoring (FIM) detects unauthorized changes to critical system files. PCI DSS Requirement 11.5 mandates FIM. If an attacker modifies /etc/passwd, replaces a binary, or plants a backdoor, FIM catches it.