Cybersecurity Ops with bash

Chapter 10. Tool: Filesystem Monitor

Malware infections and other intrusions can often be detected by the changes they make to the filesystem of a target. You can use the properties of a cryptographic hash function and a little command-line wizardry to identify files that have been added, deleted, or changed over time. This technique is most effective on systems such as servers or embedded devices that do not change significantly on a regular basis.

In this chapter, we develop a tool to create a baseline of a filesystem and compare a later state of the system to determine whether files have been added, deleted, or modified. Here are the requirements:

1. Record the path of every file on a given system.

2. Create a SHA-1 hash of every file on a given system.

3. Be able to rerun the tool at a later time and output any files that have been changed, deleted, moved, or are new.

Commands in Use

In this chapter, we introduce sdiff for file comparison.

sdiff

The sdiff command compares two files side by side and outputs any differences.

Common command options

-a

Treat all files as text files

-i

Ignore case

-s

Suppress lines common between the two files

-w

Maximum number of characters to output per line

Command example

To compare two files and output only lines that differ:

sdiff -s file1.txt file2.txt

Step 1: Baselining the Filesystem

Baselining the filesystem involves computing the message digest (hash value) of every file currently residing on the system and recording ...