Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 20:53:37 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/forensics/basic-forensic-methodology/file-integrity-monitoring.md
CPol 91d0bd6bea
GitBook: [master] 2 pages modified
2021-09-06 16:03:19 +00:00

2.1 KiB
Raw Blame History

Baseline Monitoring

Baseline

A baseline consist on take a snapshot of certain part of a system in oder to compare it with a future status to highlight changes.

For example, you can calculate and store the hash of each file of the filesystem to .be able to find out which files were modified.
This can also be done with the user accounts created, processes running, services running and any other thing that shouldn't change much, or at all.

File Integrity Monitoring

File integrity monitoring is one of the most powerful techniques used to secure IT infrastructures and business data against a wide variety of both known and unknown threats.
The goal is to generate a baseline of all the files that you want monitor and then periodically check those files for possible changes in the content, attribute, metadata....

  1. Baseline comparison, wherein one or more file attributes will be captured or calculated and stored as a baseline that can be compared against at some future time. This can be as simple as the time and date of the file, however, since this data can be easily spoofed, a more trustworthy approach is typically used. This may include periodically assessing the cryptographic checksum for a monitored file, e.g. using the MD5 or SHA-2 hashing algorithm and then comparing the result to the previously calculated checksum.

  2. Real-time change notification, which is typically implemented within or as an extension to the kernel of the operating system that will flag when a file is accessed or modified.

Tools

References