CME-1004

AIDE / File Integrity Monitoring

Detect OS/Kernel Medium Confidence

Description

Detects unauthorized modifications to critical system files by comparing against a known-good baseline database. Scheduled or continuous monitoring of /etc, /bin, /sbin, /usr.

CVSS Vector Impacts

Metric Transition Rationale
Integrity (I) H → L Compensating control: file modifications detected, alerting triggered

CWE Relationships

CWE-345

Verification

Verify AIDE is installed and database is initialized

$ aide --check 2>/dev/null; echo $?
# Expected: 0
Platform: linux

References

  • CIS RHEL 9 Benchmark — 1.3 Filesystem Integrity Checking
← CME-1003: Falco / eBPF Runtime Security CME-1005: Runtime Memory Error Detection (KASAN/HWASan) →