AIDE

AIDE (Advanced Intrusion Detection Environment) is a robust open-source, host-based file integrity monitoring (FIM) and intrusion detection system engineered to detect unauthorized modifications to files, system binaries, and system configurations on Unix-like operating systems. Operating as a trusted independent baseline verification tool, AIDE creates a cryptographic snapshot of the system state, recording file attributes, permissions, ownership, inode numbers, file sizes, modification timestamps, and cryptographic hash digests including SHA-256 and SHA-512. During routine audit cycles or automated cron executions, AIDE compares the active file system against the trusted baseline database, identifying added, modified, or deleted files with extreme precision. This capability is critical for uncovering malicious rootkits, unauthorized system binary replacements, tampering with administrative configuration files (such as /etc/passwd or /etc/shadow), and privilege escalation artifacts left by advanced persistent threat actors. AIDE provides flexible rule configuration options, allowing systems administrators to define custom regular expression patterns that exclude volatile log files while enforcing strict cryptographic checks on critical operating system libraries and kernel modules. By providing immutable audit logging and alerting capabilities, AIDE helps organizations fulfill mandatory file integrity monitoring requirements stipulated by compliance standards such as PCI-DSS, CIS Benchmarks, and NIST 800-53.