Preventing ransomware from encrypting files on a target machine
Techniques for preventing ransomware from encrypting files on a target machine are disclosed. In some embodiments, a system/process/computer program product for preventing ransomware from encrypting files on a target machine includes monitoring file system activities on a computing device; detecting an unauthorized activity associated with a honeypot file or honeypot folder; and performing an action based on a policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
1. A system, comprising:
a processor configured to:
monitor file system activities on a computing device;
detect an unauthorized activity associated with a honeypot file or honeypot folder, wherein the honeypot file is a virtual file generated as a spoofed file system response using a filter driver or the honeypot folder is a virtual folder generated as the spoofed file system response using the filter driver, wherein the virtual file is dynamically generated using the filter driver with at least one of the following: a spoofed header, a spoofed time stamp, and a spoofed file size; and
perform an action based on a policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder, wherein the action comprises one or more of the following: kill a process based on the policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder associated with the process, or generate an alert based on the policy in response to the unauthorized activity associated with the honeypot file or honeypot folder; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the processor is further configured to monitor file system activities on the computing device for one or more of the following: detecting a file open event associated with the honeypot file, detecting a setting file information event associated with the honeypot file, detecting a writing into a file event associated with the honeypot file, and detecting an enumerating a directory event associated with the honeypot folder.
3. The system of claim 1 , wherein the processor is further configured to generate a plurality of honeypot files and/or a plurality of honeypot folders.
4. The system of claim 1 , wherein the processor is further configured to generate a plurality of honeypot files and/or a plurality of honeypot folders in a protected directory.
5. The system of claim 1 , wherein detect the unauthorized activity associated with the honeypot file or the honeypot folder further comprises:
detect an enumerating directory event on a computing device;
allow a default system behavior if the enumerating directory event is associated with a non-protected directory; and
inject fake start entries if the enumerating directory event is associated with an enumeration at a beginning of a protected directory or inject fake end entries if the enumerating directory event is associated with an enumeration at an end of the protected directory.
6. The system of claim 1 , wherein the processor is further configured to kill a process based on the policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder associated with the process.
7. The system of claim 1 , wherein the processor is further configured to generate an alert based on the policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
8. A method, comprising: monitoring file system activities on a computing device; detecting an unauthorized activity associated with a honeypot file or honeypot folder, wherein the honeypot file is a virtual file generated as a spoofed file system response using a filter driver or the honeypot folder is a virtual folder generated as the spoofed file system response using the filter driver, wherein the virtual file is dynamically generated using the filter driver with at least one of the following: a spoofed header, a spoofed time stamp, and a spoofed file size; and performing an action based on a policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder, wherein the action comprises one or more of the following: killing a process based on the policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder associated with the process, or generating an alert based on the policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
9. The method of claim 8 , further comprising monitoring file system activities on the computing device for one or more of the following: detecting a file open event associated with the honeypot file, detecting a setting file information event associated with the honeypot file, detecting a writing into a file event associated with the honeypot file, and detecting an enumerating a directory event associated with the honeypot folder.
10. The method of claim 8 , further comprising generating a plurality of honeypot files and/or a plurality of honeypot folders.
11. The method of claim 8 , further comprising generating a plurality of honeypot files and/or a plurality of honeypot folders in a protected directory.
12. The method of claim 8 , further comprising killing a process based on the policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder associated with the process.
13. The method of claim 8 , further comprising generating an alert based on the policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
14. The method of claim 8 , further comprising:
detecting an enumerating directory event on a computing device;
allowing a default system behavior if the enumerating directory event is associated with a non-protected directory; and
injecting fake start entries if the enumerating directory event is associated with an is enumeration at a beginning of a protected directory or inject fake end entries if the enumerating directory event is associated with an enumeration at an end of the protected directory.
15. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
monitoring file system activities on a computing device;
detecting an unauthorized activity associated with a honeypot file or honeypot folder, wherein the honeypot file is a virtual file generated as a spoofed file system response using a filter driver or the honeypot folder is a virtual folder generated as the spoofed file system response using the filter driver, wherein the virtual file is dynamically generated using the filter driver with at least one of the following: a spoofed header, a spoofed time stamp, and a spoofed file size; and
performing an action based on a policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder, wherein the action comprises one or more of the following: killing a process based on the policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder associated with the process, or generating an alert based on the policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
16. The computer program product recited in claim 15 , further comprising computer instructions for monitoring file system activities on the computing device for one or more of the following: detecting a file open event associated with the honeypot file, detecting a setting file information event associated with the honeypot file, detecting a writing into a file event associated with the honeypot file, and detecting an enumerating a directory event associated with the honeypot folder.
17. The computer program product recited in claim 15 , further comprising computer instructions for generating a plurality of honeypot files and/or a plurality of honeypot folders.
18. The computer program product recited in claim 15 , further comprising computer instructions for generating a plurality of honeypot files and/or a plurality of honeypot folders in a protected directory.
19. The computer program product of claim 15 , further comprising computer instructions for killing a process based on the policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder associated with the process.
20. The computer program product of claim 15 , further comprising computer instructions for generating an alert based on the policy in response to the unauthorized activity associated with the honeypot file or honeypot folder.
21. The computer program product of claim 15 , further comprising computer instructions for:
detecting an enumerating directory event on a computing device;
allowing a default system behavior if the enumerating directory event is associated with a non-protected directory; and
injecting fake start entries if the enumerating directory event is associated with an enumeration at a beginning of a protected directory or inject fake end entries if the enumerating directory event is associated with an enumeration at an end of the protected directory.