deploying-ransomware-canary-files

Place decoy files with realistic names like Passwords.xlsx in directories ransomware enumerates first, then monitor them with Python's watchdog library. Any modify, rename, or delete event on a canary triggers an alert, since legitimate users never touch these files.

Use watchdog's FileSystemEventHandler to watch canary file paths and handle on_modified, on_deleted, on_moved, and on_created events. It uses OS-native APIs: inotify on Linux, FSEvents on macOS, and ReadDirectoryChangesW on Windows.

Handlers that only watch on_modified miss ransomware that writes File.xlsx.locked and unlinks the original, which fires on_moved and on_deleted instead. The handler must cover created, modified, moved, and deleted events to catch this behavior.

Place canaries in every network-share root, Documents folder, user Desktop, and backup staging directory that ransomware enumerates first. Pair realistic names with _AAAA_-prefixed and ~zzzz_-suffixed twins so a canary is touched first regardless of enumeration order.

Canary files are a detection layer, not a prevention mechanism, and cannot replace endpoint protection, backups, or network segmentation. They also require tuning to exclude backup and antivirus processes that may legitimately touch files and cause false alerts.