logo

New Tool: ficheck.py, (Thu, Jul 24th)

ID: 08ecac45-af41-5d1f-95b3-6922ea0abb80

STIX ID: report--08ecac45-af41-5d1f-95b3-6922ea0abb80

Feed Name: SANS ISC Diary

Date Published: 2025-07-24

Date Updated: 2026-04-19

...
...

The report introduces ficheck.py, a lightweight Python file integrity monitoring tool modeled after fcheck, designed to quickly detect file creations, deletions, inode changes, ownership/permission modifications, and content changes via SHA-256 hashing, with optional btime support when pystatx is present. It highlights strong performance (typically under 90 seconds), practical default monitoring of change-prone and attacker-abused directories, and provides an install script that configures a 2-hour cron job and email notifications via mailx. Links to the script and related utilities on GitHub are included for deployment and further customization.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.