domains / families / security / implementing-ransomware-kill-switch-detection

implementing-ransomware-kill-switch-detection

separate

'Analyzes ransomware kill switch mechanisms, including mutex-based execution

When to use

• Analyzing a ransomware sample to determine if it contains a kill switch mechanism (mutex, domain, registry)
• Deploying proactive mutex vaccination across endpoints to prevent known ransomware families from executing
• Monitoring DNS for kill switch domain lookups that indicate ransomware attempting to check before encrypting
• During incident response to quickly determine if a ransomware variant can be stopped by activating its kill switch
• Building detection signatures for ransomware mutex creation events using Sysmon or EDR telemetry

When not to use

• Using kill switch vaccination as a primary defense

Skill page

Source