domains / families / security / deploying-decoy-files-for-ransomware-detection

deploying-decoy-files-for-ransomware-detection

separate

'Deploys canary files (honeytokens) across file systems to detect ransomware

When to use

• Setting up early-warning detection for ransomware on file servers or endpoints
• Supplementing EDR/AV with a deception-based detection layer that catches unknown ransomware variants
• Creating high-fidelity ransomware alerts that have very low false-positive rates (legitimate users have no reason to touch decoy files)
• Testing ransomware response procedures by validating that canary file modifications trigger the expected alerting pipeline
• Protecting high-value file shares (finance, HR, legal) with tripwire files that indicate unauthorized encryption activity

When not to use

• sole ransomware defense
• prevention mechanism

Skill page

Source