The usual method is to record a cryptographic hash of each important file when it is known to be good, then compare it again later. Any difference is either an approved change or a sign of tampering. File integrity monitoring tools, such as Tripwire, automate this, and package managers can verify installed files against the vendor's checksums.
It is a way to find the quiet changes that attackers make: a modified system binary, a new script in a web directory or an altered configuration. It also works for checking that a download is genuine, by comparing its hash with the one published by the vendor.
A baseline is only useful if it is taken from a clean state and stored where an attacker cannot change it.
Monitor web directories and key system files, store baselines separately from the systems, review changes against your change records and check downloads against vendor hashes.