Ransomware Behavior Detector
<p align="center" </p
---
🎯 Overview
Ransomware behavior detection via encryption patterns, mass file operations, shadow copy deletion, backup targeting, and living-off-the-land encryption.
| Check | Severity | Description | |-------|----------|-------------| | Mass File Encryption | 🔴 CRITICAL | Rapid entropy increase, extension changes | | Shadow Copy Deletion | 🔴 CRITICAL | vssadmin, wmic, PowerShell | | Backup Targeting | 🔴 CRITICAL | Veeam, Rubrik, Commvault process kill | | Living-off-the-Land Encryption | 🟠 HIGH | cipher.exe, BitLocker, built-in tools | | ESXi/Hypervisor Targeting | 🔴 CRITICAL | No-agent encryption | | Data Staging/Exfiltration | 🟠 HIGH | Cloud storage upload pre-encryption | | Encryptionless Extortion | 🟡 MEDIUM | Pure data theft, no encryption | | Ransom Note Detection | 🟡 MEDIUM | Known ransom note patterns |
---
🚀 Quick Start
git clone https://github.com/ridhinva/ransomware-behavior-detector.git
cd ransomware-behavior-detector
pip install requests psutil
python3 ransomware_detector.py --monitor /path/to/watch --mode realtime---
⚖️ Disclaimer
For authorized security testing and defensive monitoring only.