Real ransomware extensions and ransom notes

ransomware_note_and_extensions

Renames sandbox documents to the extensions real families use (.locky, .wcry, .ryuk and others) and drops a ransom note in every subdirectory, which is the pattern filename and note-based rules match on. The note says in its own text that it is a benchmark artefact.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1486	Data Encrypted for Impact	Impact	coverage statistics
T1491.001	Internal Defacement	Impact	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other ransomware behaviour tests

Other tests in the Ransomware behaviour category.
Test	What it does	Severity
Destroying recovery points ransomware_shadow_copy_delete	Deletes the machine's volume shadow copies with vssadmin and disables the boot recovery environment, the steps ransomware takes so a restore is imposs…	critical
In-place AES encryption of sandbox files ransomware_entropy_encrypt	Creates 120 low-entropy documents in the sandbox and encrypts every one of them in place with AES-256, so the on-disk entropy of each file jumps from …	high
Ransomware-style mass rename and rewrite ransomware_mass_rename	Creates 240 documents in a sandbox directory, then renames them all to a .locked extension, overwrites a subset with high-entropy data and drops a ran…	high
Rate-controlled rename storm ransomware_rename_storm	Renames 600 sandbox files in paced batches of 50, recording how many had been renamed when something first intervened. That number is the detection th…	high
EDR canary/decoy directory probe ransomware_canary_probe	Read-only search for the canary and decoy files anti-ransomware products place on disk to detect mass file modification. Finding them shows behavioura…	low

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.