THE MECHANISM OF ANALYSIS OF SYSTEMS FOR HIDDEN CHANGES OF FILES
The paper discusses the issue of the mechanism for analyzing systems for hidden file changes, as well as features of the application of this analysis. File Integrity Monitoring (FIM), also called change monitoring, checks operating system files, Windows registries, application software, Linux system files and much more for changes that might indicate an attack. The Security Center recommends that you monitor objects using FIM, and define your own policies or FIM entities to monitor. FIM warns you of suspicious activity, for example: creation or deleting of a file key and registration of key changing files (changing file size, ACLs, or content hash); modifying the registry (resizing, ACLs, type, or content).