3 ms·
Is there any software out there detecting an unusual volume of file encryption activities from a process that could indicate it is ransomware?
by mattmcknight 3y ago
Is there any software out there detecting an unusual volume of file encryption activities from a process that could indicate it is ransomware?
- Terretta 3y ago“RansomWhere? is a utility with a simple goal; generically thwart OS X ransomware. It does so by identifying a commonality of essentially all ransomware; the creation of encrypted files.” https://objective-see.org/products/ransomwhere.html https://objective-see.org/products/ransomwhere.html For a deep dive into this line of thinking, his post: Towards Generic Ransomware Detection (04/20/2016) — https://objective-see.org/blog/blog_0x0F.html https://objective-see.org/blog/blog_0x0F.html Malwarebytes purchased an activity detecting product and claimed to offer this type of protection, though that marketing has become more generic now: https://www.malwarebytes.com/cybersecurity/business/what-is-next-generation-antivirus-ngav https://www.malwarebytes.com/cybersecurity/business/what-is-... Given AV firms change hands and veer into dark patterns, forum posts like this one shouldn't recommend anything in particular as the ownership and policies can change overnight.
- Unfrozen0688 3y agoSentinelone et al. places canary files that when encrypted flags for ransomware to central management.