EDR canary/decoy directory probe

ransomware_canary_probe

Read-only search for the canary and decoy files anti-ransomware products place on disk to detect mass file modification. Finding them shows behavioural ransomware protection is deployed; being prevented from listing them is itself a detection signal.

Severity low how bad it would be if it were real

Expected outcome Nothing should react

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1057	Process Discovery	Discovery	coverage statistics
T1083	File and Directory Discovery	Discovery	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other ransomware behaviour tests

Other tests in the Ransomware behaviour category.
Test	What it does	Severity
Destroying recovery points ransomware_shadow_copy_delete	Deletes the machine's volume shadow copies with vssadmin and disables the boot recovery environment, the steps ransomware takes so a restore is imposs…	critical
In-place AES encryption of sandbox files ransomware_entropy_encrypt	Creates 120 low-entropy documents in the sandbox and encrypts every one of them in place with AES-256, so the on-disk entropy of each file jumps from …	high
Ransomware-style mass rename and rewrite ransomware_mass_rename	Creates 240 documents in a sandbox directory, then renames them all to a .locked extension, overwrites a subset with high-entropy data and drops a ran…	high
Real ransomware extensions and ransom notes ransomware_note_and_extensions	Renames sandbox documents to the extensions real families use (.locky, .wcry, .ryuk and others) and drops a ransom note in every subdirectory, which i…	high
Rate-controlled rename storm ransomware_rename_storm	Renames 600 sandbox files in paced batches of 50, recording how many had been renamed when something first intervened. That number is the detection th…	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.