deploying-ransomware-canary-files

Deploying Ransomware Canary Files

When to Use

• Deploying proactive ransomware detection on file servers, NAS devices, or endpoint systems
• Building an early-warning system that detects ransomware before it encrypts business-critical data
• Supplementing EDR solutions with lightweight canary file monitoring on systems where agents cannot be deployed
• Testing ransomware incident response procedures by simulating canary file triggers
• Monitoring shared drives, home directories, and backup volumes for unauthorized file operations

Do not use as a replacement for endpoint protection, backup strategy, or network segmentation. Canary files are a detection layer, not a prevention mechanism.

Prerequisites

• Python 3.8+ with pip
• watchdog library (pip install watchdog)
• Write access to directories where canary files will be placed
• SMTP server credentials or Slack webhook URL for alerting
• Administrative access for placing canaries in system directories

Workflow

Step 1: Generate Canary Files

Create decoy files with realistic names and content that attract ransomware scanners. Files should have names like Passwords.xlsx, Financial_Report_2026.docx, backup_credentials.csv and contain plausible-looking but fake data. Place them in directories ransomware typically targets first: user desktops, Documents folders, network share roots, and backup paths.

Step 2: Deploy Filesystem Monitor

Use Python's watchdog library with a custom FileSystemEventHandler that watches canary file paths. The handler triggers on on_modified, on_deleted, on_moved, and on_created events for canary files. Any legitimate user or process should never touch these files, so any interaction is a high-confidence indicator of ransomware or unauthorized access.

Step 3: Configure Alert Pipeline

Wire the filesystem monitor to multiple alert channels: email via SMTP, Slack webhook POST, syslog forwarding to SIEM, and local log file. Include the triggering event type, file path, timestamp, and process information (when available) in alert payloads.