CriticalCompromise indicatorsBLWK-FIM-001

File modified since baseline: ‹path›

What this means

‹path› no longer matches its recorded baseline hash. This file is monitored because it directly controls authentication, privilege, or persistence on this host — an unexpected change here is exactly what credential theft, backdoor account creation, or PAM/sudo tampering looks like.

How to fix it

Review the file's current contents against what you expect (version control, package manager, or your own memory of the last legitimate change). If the change wasn't yours, treat this as a likely compromise. If it was legitimate, run bulwark fim baseline to record the new state as the baseline.

Check it yourself

Run a scan and look for BLWK-FIM-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads file_integrity and reports this check when:

changed == true and currently_present == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1098
• MITRE ATT&CK T1556

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005
• Credential file not covered by the baseline: ‹path› · BLWK-FIM-006