What if I told you there is a completely free way to automatically detect any ransomware infection in your environment, for free, and it takes 5 minutes to configure?

BS? Trying to sell me something? Neither! It’s true, using a simple word document and PowerShell I’ll give you a free script that cannot miss a ransomware infection.

If you’d like to hit the ground running, then start by downloading it from here:

Instructions:

1. Unzip the file, edit the .ps1 script
2. Complete steps 1-6 in the section “# Configure the variables below”
3. Copy the supplied word doc (the honeypot) into the $HoneypotDir and $HoneypotWitnessDir, feel free to use your own just ensure to use the same file in both locations for comparison
4. Map the share specified for $HoneypotDir to every client/server in your environment
5. Train your users to not edit the word document in the share
6.  You now have near instant ransomware detection!

So how does it work? Simple! All ransomware shares 1 commonality and that is that it must alter your files, typically common file formats, to then demand a ransom.

To detect the infection we create a honeypot file, a perfectly vulnerable word document that anyone can edit on a share/map network drive, then use a PowerShell script on a schedule to verify it hasn’t been changed and send an email alert when it has.

Ransomware detection used to be quite simple in that you could easily see an infection as it changed the file extension and attributes. But newer in-memory variants like Thanos can now encrypt the data without changing either! Tricky for some paid products, but not for this script because it performs 2 different tests to detect the infection.

The first test is a Test-Path to verify the file exists in the honeypot directory. File renamed, file extension changed? This immediately detects the malicious activity and sends you an email alert.

If the filename/extension hasn’t been changed then the second test runs. This uses a combination of Get-Content and Compare-Object to do a byte for byte comparison of a gold image of the word doc and your honeypot. If your word doc has been infected it now cannot miss, because you have to change the data within the word doc to encrypt it! Upon detecting any change it will also send an email alert.

If you’ve come this far then scroll back up, get downloading and implement it in your environment today. If you found this useful all I ask in return is a follow on twitter using the signature below! Happy scripting,