CANARY FILES
Hidden decoys planted in every protected folder. Nothing legitimate ever touches them, so a write or rename on one is near-certain ransomware — the highest-confidence signal it has.
11 · DESKTOP
Behavioral anti-ransomware for the endpoint.
Watches your files in real time and correlates several independent signals that together characterise a file-encrypting attack — then alerts and, optionally, suspends and terminates the attacking process before it reaches your whole drive.
Built around one idea: no single signal is trustworthy, so fuse several weak ones. Entropy can be faked, extensions vary, ransom-note names change — but a process that trips a decoy file and rewrites files with high-entropy content and re-extensions them and does it in a burst is unmistakable.
# six independent signals feed one decaying, weighted risk score RANSOMWARE SUSPECTED - CRITICAL score=100.0: 3 high-entropy writes; 3 files re-extensioned involved files: document_000.docx.encrypted, document_001.docx.encrypted, ... suspend pid 80336 (python.exe): suspended terminate pid 80336 (python.exe): terminated
Output from the detector against its own simulated attack.
Hidden decoys planted in every protected folder. Nothing legitimate ever touches them, so a write or rename on one is near-certain ransomware — the highest-confidence signal it has.
Modern families encrypt only part of each file to keep the average low. So it measures block-wise entropy and checks magic bytes — a .docx that is no longer a ZIP, a .pdf with no %PDF header — catching partial encryption that averaging misses.
Burst rates, known ransomware extensions, ransom-note filenames and recovery tampering round out the score. Past threshold it suspends the process, then terminates it.
It does not decrypt files. It reduces and contains damage — it cannot undo encryption that already happened.
It complements real offline, versioned backups. It never replaces them. If you take one thing from this page, take that one.
It is behavioral, so it infers from what a process does rather than recognising what it is. A slow, quiet attacker is a harder target than a fast, loud one.