implementing-ransomware-kill-switch-detection

name	implementing-ransomware-kill-switch-detection
description	Use when detects and exploits ransomware kill switch mechanisms including mutex-based execution guards, domain-based kill switches, and registry-based termination checks. Implements proactive mutex vaccination and kill switch domain monitoring to prevent ransomware from executing. Activates for requests involving ransomware kill switch analysis, mutex vaccination, WannaCry-style domain kill switches, or malware execution guard detection. '.
domain	cybersecurity
tags	["ransomware","kill-switch","mutex","detection","WannaCry","malware-analysis"]
subdomain	ransomware-defense
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.DS-11","RS.MA-01","RC.RP-01","PR.IR-01"]

Implementing Ransomware Kill Switch Detection

Overview

Cybersecurity skill for implementing ransomware kill switch detection. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "implementing ransomware kill switch detection"

• "Detects and exploits ransomware kill switch mechanisms including mutex-based exe"

• Analyzing a ransomware sample to determine if it contains a kill switch mechanism (mutex, domain, registry)

• Deploying proactive mutex vaccination across endpoints to prevent known ransomware families from executing

• Monitoring DNS for kill switch domain lookups that indicate ransomware attempting to check before encrypting

• During incident response to quickly determine if a ransomware variant can be stopped by activating its kill switch

• Building detection signatures for ransomware mutex creation events using Sysmon or EDR telemetry

Do not use kill switch vaccination as a primary defense. Not all ransomware families implement kill switches, and those that do may remove them in newer versions. This is a supplementary detection and prevention layer.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Python 3.8+ with ctypes (Windows) for mutex creation and enumeration
• Sysmon installed with Event ID 1 (process creation) and Event ID 17/18 (pipe/mutex events) configured
• Access to malware analysis sandbox for identifying kill switch mechanisms in samples
• DNS monitoring capability for detecting kill switch domain resolution attempts
• Familiarity with Windows internals: mutexes (mutants), kernel objects, named pipes
• Reference database of known ransomware mutexes (github.com/albertzsigovits/malware-mutex)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    : ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}