HighCompromise indicatorsBLWK-FIM-002

File deleted since baseline: ‹path›

What this means

‹path› was present when the file-integrity baseline was recorded and is now missing. Deleting a security-critical file (rather than modifying it) is also a documented defense-evasion pattern — removing logs, PAM modules, or cron definitions to cover tracks or disable a control.

How to fix it

Confirm whether the deletion was intentional (e.g. deliberate service removal). If not, restore the file from a package manager reinstall or backup, then run bulwark fim baseline once the host is back to a known-good state.

Check it yourself

Run a scan and look for BLWK-FIM-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads file_integrity and reports this check when:

changed == true and currently_present == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1070

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005
• Credential file not covered by the baseline: ‹path› · BLWK-FIM-006