Full Report
Read about the value of Huntress' Ransomware Canaries service, a mechanism to deliver faster detection of a ransomware incident.
Analysis Summary
# Tool/Technique: Ransomware Canaries
## Overview
Ransomware Canaries is a proactive detection technique and service provided by Huntress. It utilizes "tripwire" files placed on endpoints to provide early warning of ransomware activity. The goal is to reduce the "dwell time" between the start of an encryption event and the initiation of incident response, allowing defenders to contain threats before widespread data loss occurs.
## Technical Details
- **Type:** Detection Technique / Sentinel Files
- **Platform:** Windows (implied by user profiles and Huntress agent deployment)
- **Capabilities:** Passive monitoring, file integrity monitoring, automated alerting, exfiltration tracking.
- **First Seen:** Service announced June 24, 2020.
## MITRE ATT&CK Mapping
- **[TA0040 - Impact]**
- **[T1486 - Data Encrypted for Impact]**: The technique is designed specifically to detect this Tactic/Technique as it occurs.
- **[TA0010 - Exfiltration]**
- **[T1020 - Automated Exfiltration]**: Detected via tracking of unique files found outside the environment.
## Functionality
### Core Capabilities
* **Sentinel File Placement:** The Huntress agent deploys unique "canary" files across various directories on an endpoint.
* **File Integrity Monitoring:** The service monitors these specific files for any modifications, renames, or encryption attempts.
* **ThreatOps Validation:** When a file change is detected, an alert is sent to a human-led ThreatOps team to distinguish between legitimate user activity and malicious encryption.
* **Early Incident Trigger:** Provides an immediate signal to activate incident response playbooks, often hours or days before a user discovers a ransom note.
### Advanced Features
* **Unique QR Coding:** Each canary file contains a QR code unique to the specific user profile and endpoint.
* **Exfiltration Tracking:** If stolen data is leaked on the dark web or public forums, the presence of these unique canary files allows investigators to trace the exact source (account and machine) of the data breach.
* **False Positive Reduction:** Uses intelligence-driven filtering to ensure that standard system changes do not trigger "cry wolf" alerts for MSPs.
## Indicators of Compromise
* **File Hashes:** N/A (Files are unique to each user/endpoint).
* **File Names:** Randomly generated or common document names designed to appear attractive to automated encryption scripts.
* **Behavioral Indicators:**
* `Modification/Deletion` of hidden or specific sentinel files.
* `Bulk file renaming` within directories containing canary files.
## Associated Threat Actors
The technique is designed to detect any actor utilizing ransomware, including but not limited to:
* CryptoLocker variants
* Locky
* Sodinokibi (REvil)
* Maze
## Detection Methods
* **Behavioral detection:** Monitoring for unauthorized processes attempting to write to or modify the Ransomware Canary files.
* **Integrity Checking:** Constant background polling by the Huntress agent to verify the state of the canary files.
## Mitigation Strategies
* **Rapid Containment:** Using the alert to immediately isolate the infected host from the network.
* **Backup Activation:** Triggering data restoration immediately upon confirmed detection to minimize downtime.
* **Endpoint Isolation:** Hardening endpoints by restricting write access to sensitive directories where possible.
## Related Tools/Techniques
* **Honeyfiles / Honeypots:** The broader category of "deception technology" to which canaries belong.
* **Managed Antivirus:** Complementary service for preventing the execution of the ransomware binaries.
* **Managed SIEM:** Used for correlating canary alerts with other network telemetry.