| name | detecting-ransomware-encryption-behavior |
| description | Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file modification, abnormal entropy spikes in written data, and suspicious process behavior characteristic of encryption routines. Use when building real-time ransomware detection, tuning entropy thresholds, or investigating suspected active encryption on an endpoint.
|
| domain | cybersecurity |
| subdomain | ransomware-defense |
| tags | ["ransomware","detection","entropy","behavioral-analysis","file-monitoring","heuristics"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"] |
| mitre_attack | ["T1078","T1190","T1059","T1486","T1490"] |
| mitre_f3 | {"version":"1.1","tactics":["monetization","positioning","stealth"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017.001","name":"Conversion to Physical Monetary Instruments: Cash","tactic":"monetization","source":"f3"},{"id":"T1219","name":"Remote Access Tools","tactic":"positioning","source":"attack"},{"id":"T1070","name":"Indicator Removal","tactic":"stealth","source":"attack"}]} |
Detecting Ransomware Encryption Behavior
When to Use
- Building or tuning a behavioral detection layer for ransomware that catches unknown/zero-day variants
- Monitoring file servers and endpoints for mass encryption activity that evades signature-based detection
- Implementing entropy-based detection to identify when files are being replaced with encrypted (high-entropy) content
- Analyzing suspicious process behavior patterns: rapid sequential file opens, writes, renames, and deletes
- Validating EDR detection rules against actual ransomware encryption patterns during red team exercises
Do not use entropy analysis alone as the only detection signal. Compressed files (ZIP, JPEG, MP4) naturally have high entropy and will cause false positives. Always combine entropy with behavioral signals like I/O rate and file rename patterns.
Prerequisites
- Python 3.8+ with
watchdog and psutil libraries
- Administrative access for process monitoring and file system event capture
- Understanding of Shannon entropy and its application to file content analysis
- Windows: Sysmon installed for detailed process and file system event logging
- Linux: auditd configured for file access monitoring, or inotify-based watchers
- Baseline entropy values for common file types in the monitored environment
Workflow
Step 1: Establish Entropy Baselines
Calculate normal entropy ranges for files in the environment:
Entropy Baselines by File Type:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
File Type Normal Entropy Encrypted Entropy
.docx 3.5 - 6.5 7.8 - 8.0
.xlsx 4.0 - 6.8 7.8 - 8.0
.pdf 5.0 - 7.2 7.8 - 8.0
.txt 2.0 - 5.0 7.8 - 8.0
.csv 2.0 - 5.5 7.8 - 8.0
.sql 2.5 - 5.0 7.8 - 8.0
.jpg/.png 7.0 - 7.9 7.9 - 8.0 (hard to distinguish)
.zip/.7z 7.5 - 8.0 7.9 - 8.0 (hard to distinguish)
Key insight: Text-based files show the largest entropy jump when encrypted,
making them the best candidates for entropy-based detection.
Step 2: Implement Real-Time Entropy Monitoring
Monitor file writes and calculate entropy of new content:
import math
from collections import Counter
def shannon_entropy(data):
"""Calculate Shannon entropy of byte data (0.0 to 8.0 scale)."""
data:
freq = Counter(data)
length = (data)
-((c / length) * math.log2(c / length) c freq.values())
():
entropy = shannon_entropy(data)
entropy >= threshold, entropy
