What Is File Integrity Monitoring?
File Integrity Monitoring (FIM) detects unauthorized changes to important files — the modified system binary, the web shell dropped on a server, the quietly edited configuration. It works by comparing files against a known-good baseline, so anything an attacker alters stands out. It is one of the more reliable ways to catch persistence and tampering that leave a mark on disk.
How does FIM work?#
The mechanism is baseline-and-compare, using cryptographic hashes:
- Baseline — record hashes and attributes of known-good files and directories.
- Monitor — periodically or continuously recompute and compare.
- Alert — flag any modification, addition, deletion, or permission change.
Because even a one-byte change alters the hash completely, tampering is detectable regardless of how subtle it is — you cannot quietly edit a monitored file without the hash betraying you.
What FIM catches, and the tuning challenge#
FIM is strong at spotting file-based attacker activity:
| Detects | Example |
|---|---|
| Dropped files | Web shells, malware |
| Modified binaries/config | Backdoored system files |
| Log tampering | Attackers covering tracks |
| Permission changes | Weakening of access controls |
The catch is noise: legitimate changes (patches, deployments) constantly alter files, so FIM must be scoped to genuinely critical files and tuned to expected changes — otherwise it becomes another source of alert fatigue.
File integrity monitoring detects tampering on disk. More at the Defense & Hardening hub.
Frequently asked questions#
What is file integrity monitoring?
File Integrity Monitoring (FIM) watches critical files and directories for changes — modifications, additions, deletions, permission changes — and alerts when they occur. It works by recording a baseline (often cryptographic hashes) of known-good files and comparing against it, so unauthorized or unexpected changes stand out as potential signs of compromise.
What does FIM detect?
FIM catches attacker activity that alters files: web shells dropped on a server, modified system binaries or configurations, tampering with logs, and changes to critical application files. It is especially valuable for detecting persistence and tampering that other tools might miss, and it is a common compliance requirement.