File Integrity Monitoring

Signature-based scanning only catches content matching a known pattern. A payload hand-inserted into an already-trusted file can dodge every signature check while still being a real backdoor. File Integrity Monitoring catches that class of compromise instead.

How It Works

• Create Baseline — one click hashes every scanned file with SHA-256 and stores it as your site's known-good snapshot.
• Check Integrity Now — re-hashes files and compares them against the baseline on demand or automatically as part of a scheduled check.
• Narrow, High-Signal Detection — only files present in both the baseline and the current scan with a different hash are reported. A brand-new file is left to the regular scanner's own checks.
• Never Auto-Updates — the baseline only moves forward when you explicitly rebuild it, since legitimate updates can also change files.

Drift found during a scheduled check uses the same email, Slack, Discord, and Telegram alerts as a signature-based finding, so there is no separate notification workflow to learn. Integrity drift is flagged at Medium confidence by design because a legitimate extension update can also change files, and the hash comparison alone cannot distinguish an update from tampering.

MuRu Guard File Integrity Monitoring with baseline and integrity check controls.