Huntress Updates Ransomware Canaries With More File Types and System-Level Monitoring
Summary
Huntress’s Ransomware Canaries update adds XLSX and PDF canaries, monitoring in system profiles, partner branding, and improved differentiation between EFS encryption and potentially malicious encryption.
Key points
- Ransomware Canaries are monitored hidden endpoint files intended to alert Huntress when ransomware encrypts data, enabling an earlier investigation.
- Version 2 adds XLSX and PDF canaries alongside the existing DOCX files to broaden file-encryption visibility.
- Canaries will also be monitored in system profiles, extending coverage beyond user profiles.
- The update helps distinguish EFS-encrypted files from files encrypted by potentially malicious activity, reducing false-positive reporting.
- Canary files can display a partner company’s branding and direct users to that company’s support page.
Article Details
- Event Type
- Huntress announced an update to its Ransomware Canaries service, adding customizable branding, .xlsx and .pdf canary files, monitoring in system profiles, and the ability to distinguish Encrypting File System (EFS) encryption from potentially malicious encryption.
- Impact
- The update expands visibility into ransomware encryption across additional file types and system-level locations, helps reduce false-positive alerts for EFS, and directs users who find a canary to their own company’s support page. The article reports no specific ransomware incident or victim impact.