Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 12:43:23 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/forensics/basic-forensic-methodology/file-integrity-monitoring.md
CPol ca460fcd40
GitBook: [master] 3 pages modified
2021-09-06 15:03:23 +00:00

1.3 KiB
Raw Blame History

File Integrity Monitoring

File integrity monitoring is one of the most powerful techniques used to secure IT infrastructures and business data against a wide variety of both known and unknown threats.
The goal is to generate a baseline of all the files that you want monitor and then periodically check those files for possible changes in the content, attribute, metadata....

  1. Baseline comparison, wherein one or more file attributes will be captured or calculated and stored as a baseline that can be compared against at some future time. This can be as simple as the time and date of the file, however, since this data can be easily spoofed, a more trustworthy approach is typically used. This may include periodically assessing the cryptographic checksum for a monitored file, e.g. using the MD5 or SHA-2 hashing algorithm and then comparing the result to the previously calculated checksum.

  2. Real-time change notification, which is typically implemented within or as an extension to the kernel of the operating system that will flag when a file is accessed or modified.

References