We don't look for the contents, we're more interested that a file was modified, things like /etc/shadow. We can always get on the box if we need the content, but for detection the fact that it changed is typically enough