File Integrity Monitoring Tools: Detecting Unauthorized Changes

File integrity monitoring detects unauthorized modifications to critical system files, configuration files, and application code. When an attacker compromises a system, they almost always modify files, whether to install backdoors, alter configurations, replace legitimate executables with trojaned versions, or plant web shells on compromised servers. FIM tools create cryptographic baselines of monitored files and alert when any file deviates from its known-good state, providing an early warning of compromise that other security tools may miss.

Why FIM Is Essential

Many attacks go undetected for months because attackers modify systems subtly enough to avoid triggering endpoint protection or network monitoring alerts. A web shell planted in a web server directory, a modified SSH configuration that accepts an additional key, or a replaced system binary that includes a backdoor may not trigger antivirus alerts because the modifications appear as legitimate file operations.

FIM catches these changes by monitoring what should be static. System binaries, configuration files, and application code should only change during planned updates and maintenance. Any modification outside of a change management window is suspicious and warrants investigation.

Compliance frameworks including PCI DSS, HIPAA, SOX, and NIST explicitly require file integrity monitoring as a security control. PCI DSS Requirement 11.5 specifically mandates FIM for critical system files, and auditors verify that FIM is deployed, configured, and generating actionable alerts.

How FIM Works

FIM tools operate by creating a baseline of cryptographic hashes for every monitored file. SHA-256 or similar hash algorithms generate a unique fingerprint for each file. Periodically, or in real time, the FIM tool recalculates hashes and compares them to the baseline. Any change in a file, no matter how small, produces a completely different hash value.

Beyond hash changes, FIM tools monitor file metadata including permissions, ownership, timestamps, and access control lists. An attacker who changes file permissions to make a sensitive configuration world-readable without modifying the file content still triggers an alert.

Real-time FIM uses operating system-level file system monitoring hooks to detect changes as they happen. This approach provides immediate alerting but consumes more system resources. Periodic FIM runs scheduled scans at defined intervals, trading detection speed for lower resource usage.

Leading FIM Solutions

OSSEC is an open-source host-based intrusion detection system that includes robust file integrity monitoring capabilities. It monitors file changes, log analysis, rootkit detection, and active response across Windows, Linux, and macOS systems. OSSEC uses a manager-agent architecture where agents on monitored systems report to a central manager for correlation and alerting. The open-source license and active community make it accessible for organizations of any size.

Tripwire Enterprise is one of the most established commercial FIM solutions. It provides real-time file integrity monitoring with detailed change attribution, policy-based monitoring, and integration with change management systems. Tripwire can correlate detected changes with approved change tickets, automatically classifying authorized changes and flagging unauthorized modifications for investigation. The Tripwire Open Source edition provides basic FIM capabilities for Linux systems.

Wazuh extends the OSSEC foundation with additional capabilities including vulnerability detection, regulatory compliance dashboards, cloud security monitoring, and integration with the Elastic Stack for visualization and analysis. Wazuh provides FIM alongside log analysis, intrusion detection, and configuration assessment in a unified open-source platform.

SolarWinds Security Event Manager includes file integrity monitoring as part of its SIEM functionality. FIM changes feed directly into the SIEM correlation engine alongside log events, providing context for investigating whether file modifications are related to other suspicious activity.

Qualys FIM provides cloud-managed file integrity monitoring that deploys through the Qualys agent. It supports real-time and periodic monitoring with centralized policy management and reporting. The cloud-based approach simplifies deployment and management compared to self-hosted FIM solutions.

Configuration and Tuning

Define monitoring policies that focus on critical files and directories. Monitor system binaries, configuration files for critical services, web application directories, SSH authorized keys files, cron job configurations, and startup scripts. Monitoring everything generates excessive noise from legitimate temporary files, logs, and caches.

Establish change management integration so that authorized changes are distinguished from unauthorized ones. When a system administrator deploys a patch during a maintenance window, the resulting file changes should be automatically classified as authorized. Changes outside of approved windows should generate high-priority alerts.

Baseline your systems after confirming they are in a known-good state. Creating a baseline from an already-compromised system means the FIM tool will treat the compromised state as normal. Verify system integrity through vulnerability scanning and security assessment before establishing FIM baselines.

Integrate FIM alerts with your incident response plan so that unauthorized file changes trigger appropriate investigation workflows. A modified system binary on a production server warrants immediate investigation with higher priority than a changed configuration file on a development system.

FIM as Part of Defense in Depth

File integrity monitoring excels at detecting post-compromise activity that other tools miss, but it does not prevent initial compromise. Combine FIM with endpoint protection, access controls, network monitoring, and vulnerability management for comprehensive defense. FIM serves as a critical detection layer that catches changes attackers make after gaining access, providing the evidence needed to investigate and contain incidents before they escalate.