deploying-decoy-files-for-ransomware-detection

Featured

Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrity monitoring or OS-level watchdogs to trigger alerts when ransomware modifies or encrypts them. Activates for requests involving ransomware canary deployment, honeyfile setup, deception-based ransomware detection, or file integrity monitoring for encryption.

DevOps & Infrastructure 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Deploying Decoy Files for Ransomware Detection ## When to Use - Setting up early-warning detection for ransomware on file servers or endpoints - Supplementing EDR/AV with a deception-based detection layer that catches unknown ransomware variants - Creating high-fidelity ransomware alerts that have very low false-positive rates (legitimate users have no reason to touch decoy files) - Testing ransomware response procedures by validating that canary file modifications trigger the expected alerting pipeline - Protecting high-value file shares (finance, HR, legal) with tripwire files that indicate unauthorized encryption activity **Do not use** decoy files as the sole ransomware defense. They are a detection mechanism, not a prevention mechanism, and should complement backups, EDR, and access controls. ## Prerequisites - Python 3.8+ with `watchdog` library for cross-platform file system monitoring - Administrative access to target file shares or endpoints for canary placement - File integrity monitoring (FIM) tool or SIEM integration for alert routing - Understanding of target directory structure to place canaries in high-value locations - Windows: NTFS change journal or ReadDirectoryChangesW API access - Linux: inotify support in kernel (standard in modern kernels) ## Workflow ### Step 1: Design Canary File Strategy Plan file placement for maximum detection coverage: ``` Canary File Placement Strategy: ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Naming Convention: - Use names tha...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

deploying-ransomware-canary-files

Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and triggers immediate alerts via email, Slack webhook, or syslog when interaction is detected, providing early warning before full encryption begins.

12,642 Updated today
mukul975
AI & Automation Featured

implementing-honeypot-for-ransomware-detection

Deploys canary files, honeypot shares, and decoy systems to detect ransomware activity at the earliest possible stage. Configures canary tokens embedded in strategic file locations that trigger alerts when ransomware attempts encryption, uses honeypot network shares that mimic high-value targets, and deploys Thinkst Canary appliances for comprehensive deception-based detection. Activates for requests involving ransomware honeypots, canary files, deception technology for ransomware, or early ransomware alerting.

12,642 Updated today
mukul975
AI & Automation Featured

detecting-ransomware-encryption-behavior

Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring, and behavioral heuristics. Identifies mass file modification patterns, abnormal entropy spikes in written data, and suspicious process behavior characteristic of ransomware encryption routines. Activates for requests involving ransomware behavioral detection, entropy-based file monitoring, I/O anomaly detection, or real-time encryption activity alerting.

12,642 Updated today
mukul975
AI & Automation Featured

detecting-ransomware-precursors-in-network

Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.

12,642 Updated today
mukul975
DevOps & Infrastructure Featured

implementing-canary-tokens-for-network-intrusion

Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement. Integrates with webhook alerting (Slack, Teams, email, generic HTTP) for real-time intrusion notifications. Provides automated token generation, placement strategies, and monitoring for enterprise network environments. Use when building deception-based network intrusion detection with Canarytokens.org and Thinkst Canary platforms.

12,642 Updated today
mukul975