Ransomware early warning and traps

The signals scored before and during encryption, canary files, and decoy credentials that raise a finding the moment someone uses them.

Ransomware EWS scores the signals that come before and during encryption into one threat level for your organisation: Safe, Warning, Critical or Active attack. The page shows the machines affected, a timeline, and What to do now.

Signals come from real telemetry from the Windows agent. File signals need Sysmon, which the agent’s installer sets up. What this page watches on the page lists every signal.

What is scored

Signal	Weight
A canary file was written to, or a trap was used	100
A ransom note was created	95
50 or more files written on one machine within two minutes	90
Shadow copies deleted	85
Backups deleted, or boot recovery disabled	80
25 or more files in at least three folders took one unusual extension within five minutes	70
Database, backup or security services stopped	65
Windows Defender disabled	45
The Windows Security log cleared	40

Canary files

Canary files lists trap files you place in folders people use. Nothing legitimate writes to them, so a write raises the highest score at once. The trap is watched through Sysmon file events, so the machine needs the agent with Sysmon.

Decoy credentials

Deception Grid makes credentials and accounts nobody should ever use. There are eight token types: an AWS access key, a GitHub token, an API key, a password, a database URL, a JWT, an Azure client secret and an SSH private key.

Under Ready traps:

Fires on its own: Legit AI sees the trap being used in data it already collects.
Needs your integration: something outside Legit AI has to report the use, such as AWS or GitHub. On your own server, Legit AI sets the secret these reports need at your request.

My traps lists what you have placed, and Trap alerts what has fired. A used trap raises a finding and counts as the top ransomware signal.