FIM

FIM tools watch critical files and configurations and alert when they change unexpectedly. Attackers frequently modify files to hide, persist, or plant malicious code, so SOC teams use FIM to detect tampering with system binaries, web content, or configuration files, which often signals an intrusion. It is also required by standards like PCI DSS.