Lion Cipher Lab
File integrity monitoring with AIDE
- Digital Forensics & IR (DFIR)
- Beginner
- ~30 min
- Free · no account required
Why it matters
When an attacker gets onto a machine, they rarely stop at getting in — they change things to stay. They drop a backdoor, edit a startup file so their code runs on every boot, swap a system binary for a tampered copy, or quietly add themselves an account. All of that is a change to files that, on a healthy system, almost never change. File integrity monitoring is the detection built on exactly that fact: you record a trusted fingerprint of your system's files while you know it is clean, then compare against it later, and anything that moved without a good reason gets flagged. It is one of the…
What you'll learn
- file integrity monitoring
- detecting unauthorized changes
- installing and using AIDE
- capturing a trusted baseline
- reading a FIM report
- tuning integrity rules
- protecting and scheduling checks
Steps in this lab
- What file integrity monitoring is, and why attackers trip it
- Install AIDE
- See what AIDE is set to watch
- Capture the trusted baseline
- Make a change — your harmless canary
- Run a check and catch it
- Tune what it watches
- The operational reality — protect the baseline, run it on a schedule
- Why this is one of the best returns in defence