AIDE
also: Advanced Intrusion Detection Environment
AIDE (Advanced Intrusion Detection Environment) is a file integrity monitoring tool that detects unauthorized changes to system files by comparing their current state against a stored database of known-good checksums and attributes.
AIDE creates a baseline database of file checksums, permissions, ownership, and other metadata. It then periodically scans the filesystem and compares current files against this baseline to detect modifications, additions, or deletions that might indicate a security compromise or unauthorized tampering.
Common use case: After installing a Linux system and hardening its security, you generate an AIDE database. Later, if an attacker modifies system binaries like /bin/ls or /usr/sbin/sshd, AIDE detects these changes when you run a check, alerting you to potential intrusion.
AIDE is often used alongside log monitoring and intrusion detection systems (IDS) as part of a defense-in-depth security strategy. It's particularly valuable for detecting rootkits and backdoors that modify core system files.