Glossary
File integrity monitoring (FIM)
Detecting changes to files by comparing them against a trusted baseline of hashes, attributes and permissions.
File integrity monitoring (FIM) records a trusted baseline of files — hashes, sizes, permissions, owners, timestamps — and alerts when they change. Tools include AIDE, Tripwire, Wazuh syscheck, osquery, auditd watches and Sysmon file-creation events.
For web shell defence, FIM should cover every directory a web server can execute code from plus its configuration files, and changes should be reconciled against deployments. An executable file written by the web server process itself is a high-priority alert. See file integrity detection.