Ransomware mitigation system
Endpoints in a network environment include remote file systems mounted thereto that reference a file system generator that responds to file system commands with deception data. Requests to list the contents of a directory are intercepted, such as while a response is passed up through an IO stack. The response is modified to include references to deception files and directories that do not actually exist on the system hosting the file system generator. The number of the deception files and directories may be randomly selected. Requests to read deception files are answered by generating a file having a file type corresponding to the deception file. Deception files may be written back to the system by an attacker and then deleted.
1. A method comprising:
receiving, by a computer system, a file system query from a remote endpoint having the computer system mounted thereto as a remote file system;
in response to the file system query, returning, by the computer system, to the remote endpoint, a deception directory listing including references to one or more deception files and one or more deception directories that do not correspond to any actual files and do not correspond to any actual directories;
receiving, by the computer system, a request to list contents of one of the deception directories; and
in response to the request to list contents of the one of the one or more deception directories:
generating, by the computer system, references to at least one additional deception directory and additional deception files that do not correspond to any actual files and do not correspond to any actual directories; and
returning, by the computer system, to the remote endpoint, a listing of the references to the at least one additional deception directory and additional deception files.
2. The method of claim 1 , further comprising:
intercepting, by the computer system, a response to the file system query from an operating system executing on the computer system;
modifying, by the computer system, the response to obtain a modified response including the references to the one or more deception files and the one or more deception directories; and
returning the response, by the operating system, the modified response to the endpoint.
3. The method of claim 2 , wherein intercepting the response to the file system query from the operating system comprises intercepting a response from a file system driver; and
wherein modifying the response to obtain the modified response comprises adding the references to the one or more deception files and the one or more deception directories to the response from the file system driver.
4. The method of claim 1 , wherein the remote endpoint has one or more other actual remote storage devices mounted thereto and accessible as part of a file system of the remote endpoint.
5. The method of claim 1 , further comprising:
receiving, by the computer system, from the remote endpoint, a request for the one or more deception files;
in response to the request for the one or more deception files, creating, by the computer system, one or more decoy files; and
returning, by the computer system, to the remote endpoint, the one or more decoy files.
6. The method of claim 5 , further comprising:
receiving, by the computer system, from the remote endpoint, a request to overwrite the one or more decoy files with one or more encrypted files;
in response to the request to overwrite the one or more decoy files, writing, by the computer system, the one or more encrypted files to a storage device; and
deleting, by the computer system, the one or more encrypted files from the storage device.
7. The method of claim 5 , wherein creating the decoy files comprises including metadata in the decoy files formatted according to file types of the one or more deception files.
8. The method of claim 7 , wherein creating the decoy files comprises including a time of creation in the metadata of each file of the one or more decoy files that is different from a time of creating the each file.
9. The method of claim 1 , further comprising:
generating, by the computer system, one or more random numbers; and
selecting, by the computer system, a first number of the deception files and a second number of the deception directories according to the one or more random numbers.
10. A system comprising:
one or more processing devices;
a storage device;
one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code effective to cause the one or more processing devices to:
receive a file system query from a remote endpoint having the system mounted thereto as a remote file system;
in response to the file system query, generate, a first deception directory listing including references to one or more first deception files and one or more first deception directories that do not correspond to any actual files and do not correspond to any actual directories;
store the first deception directory listing on the storage device;
return the first deception directory listing to the remote endpoint
receive, from the remote endpoint, a request to list contents of one of the one or more first deception directories in the first deception directory; and
in response to the request to list contents of the one of the one or more first deception directories:
generate a second deception directory listing including references to at least one additional deception directory and additional deception files that do not correspond to any actual files and do not correspond to any actual directories;
return the second deception directory listing to the remote endpoint; and
delete the first deception directory listing from the storage device.
11. The system of claim 10 , wherein the executable code is further effective to cause the one or more processing devices to:
intercept a response to the file system query from an operating system executed by the one or more processing devices;
modify the response to obtain a modified response including the first deception directory listing; and
return, by the operating system, the modified response to the endpoint.
12. The system of claim 11 , wherein the executable code is further effective to cause the one or more processing devices to:
intercept the response to the file system query from the operating system by intercepting a response from a file system driver; and
modify the response to obtain the modified response by adding the first deception directory listing to the response from the file system driver.
13. The system of claim 10 , wherein the remote endpoint has one or more other actual remote storage devices mounted thereto and accessible as part of a file system of the remote endpoint.
14. The system of claim 10 , wherein the executable code is further effective to cause the one or more processing devices to:
receive, from the remote endpoint, a request for the one or more first deception files;
in response to the request for the one or more first deception files, create one or more decoy files; and
return, to the remote endpoint, the one or more decoy files.
15. The system of claim 14 , wherein the executable code is further effective to cause the one or more processing devices to:
receive, from the remote endpoint, a request to overwrite the one or more decoy files with one or more encrypted files;
in response to the request to overwrite the one or more decoy files, write, the one or more encrypted files to the storage device; and
delete, the one or more encrypted files from the storage device.
16. The system of claim 14 , wherein the executable code is further effective to cause the one or more processing devices to create the decoy files by including metadata in the decoy files formatted according to file types of the one or more first deception files.
17. The system of claim 16 , wherein the executable code is further effective to cause the one or more processing devices to create the decoy files by including a time of creation in the metadata of each file of the one or more decoy files that is different from a time of creating the each file.
18. The system of claim 10 , wherein the executable code is further effective to cause the one or more processing devices to:
generate one or more random numbers; and
select a first number of the first deception files and a second number of the first deception directories according to the one or more random numbers.