A file baseline is a trusted inventory of files expected on a system or in a software directory. It can record file names and locations along with hashes, digital signatures, and version information. Comparing current files with this reference helps reveal changes that may be unauthorized.
Baselines matter because malware can hide in familiar paths, including directories used by legitimate tools. Defenders can compare files against approved inventories, alert on unexpected or unsigned binaries, and investigate changes to services that launch them. Baselines need to be maintained as software is updated, so normal changes are distinguished from suspicious ones.