Files to monitor

[toosweetnitemare]

All,
I have been googling around for different guides on what files to monitor that people would edit for malicious intent. In my readings so far, i have found the common files people edit.
so far i have found:

1. /etc/hosts
2. ufw config files
3. /bin/login

what other files do you guys monitor actively and why?

Thanks in advance!
-tsnm

[tgalati4]

/var/log/auth.log What admin activities are taking place on the system.

[toosweetnitemare]

/var/log/auth.log What admin activities are taking place on the system.

would this be more for a file to watch what changes happen or one that no changes should happen to?

Thanks!