CriticalCompromise indicatorsBLWK-FIM-004

Credential file modified since baseline: ‹path›

What this means

‹path› no longer matches its recorded baseline hash. This is one of the two root-only credential/privilege files Bulwark tracks (/etc/shadow, /etc/sudoers) — a change here is about as direct a signal of credential tampering or privilege-escalation setup as this host can produce.

How to fix it

Review the change immediately. If it wasn't yours (a password reset via passwd, or a deliberate visudo edit), treat this as a likely compromise. If legitimate, re-run sudo bulwark fim baseline --privileged to record the new known-good state.

Check it yourself

Run a scan and look for BLWK-FIM-004 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads file_integrity_privileged and reports this check when:

changed == true and currently_present == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1098
• MITRE ATT&CK T1548.003

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005
• Credential file not covered by the baseline: ‹path› · BLWK-FIM-006