Baseline Monitoring
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
A baseline consists of taking a snapshot of certain parts of a system to compare it with a future status to highlight changes.
For example, you can calculate and store the hash of each file of the filesystem to be able to find out which files were modified. This can also be done with the user accounts created, processes running, services running and any other thing that shouldn't change much, or at all.
File Integrity Monitoring (FIM) is a critical security technique that protects IT environments and data by tracking changes in files. It involves two key steps:
Baseline Comparison: Establish a baseline using file attributes or cryptographic checksums (like MD5 or SHA-2) for future comparisons to detect modifications.
Real-Time Change Notification: Get instant alerts when files are accessed or altered, typically through OS kernel extensions.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
