What problem does it solve?
Ransomware often encrypts files before traditional antivirus or EDR tools raise an alert, leaving teams blind until damage is done. This Skill sets up deception-based tripwires — decoy files that legitimate users never touch — so any modification, rename, or deletion immediately signals active ransomware encryption.
Core Features & Use Cases
- Strategic Canary Placement: Guides placement of decoy files that sort first and last alphabetically in every share, endpoint folder, and backup staging directory to catch both A-Z and Z-A enumerators early.
- Realistic Decoy Generation: Creates convincing .docx, .xlsx, and text canaries with realistic content and metadata using python-docx.
- File System Watching: Implements a Python watchdog-based monitor that catches modification, deletion, and rename events (including ransomware's rename-to-new-extension pattern).
- Alert Response Matrix: Defines severity tiers and automated responses, from SOC alerts to process kills and network isolation when multiple canaries trip.
- Use Case: A security engineer seeds canary files across Finance and HR shares, then validates the pipeline by simulating encryption and confirming a SOC alert arrives within 30 seconds.
Quick Start
Deploy canary files across my file shares and set up a watchdog monitor that alerts the SOC when any decoy is modified, renamed, or deleted.
