Deploys honeypot decoy files, canary tokens, and network shares on Windows servers to detect ransomware encryption attempts early using PowerShell scripts and FSRM monitoring.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 使用诱饵文件为勒索软件加密尝试部署早期预警检测
Deploys canary files, honeypot shares, and decoy systems to detect ransomware encryption attempts early via triggered alerts. Supplements EDR/SIEM with deception tech on Windows file servers.
Deploys canary files on file shares, honeypot shares, and decoy systems to detect ransomware encryption attempts early via behavioral alerts.
Deploys and monitors ransomware canary files with Python watchdog in key directories, detecting reads/modifies/deletes and alerting via email, Slack Webhook, or Syslog for early warning.
Share bugs, ideas, or general feedback.
不要将其用作唯一的勒索软件检测机制。蜜罐是高置信度的补充层,而非 EDR、网络监控和备份保护的替代品。
在勒索软件加密过程中会遇到的战略位置放置诱饵文件:
# 在所有文件共享中部署诱饵文件
# 文件命名使其在字母顺序和目录顺序中靠前出现
# 勒索软件通常按字母顺序或目录遍历顺序加密
$shares = @("\\fileserver01\finance", "\\fileserver01\hr", "\\fileserver01\engineering")
$canaryNames = @(
"!_IMPORTANT_DO_NOT_DELETE.docx",
"000_Budget_2026_FINAL.xlsx",
"_Confidential_Employee_Records.pdf",
"AAAA_Quarterly_Report.docx"
)
foreach ($share in $shares) {
foreach ($name in $canaryNames) {
$targetPath = Join-Path $share $name
# 创建看起来合法的诱饵文件内容
# 文件包含访问时触发的唯一令牌
$content = "This document contains confidential financial data.`n"
$content += "Q4 2025 Revenue: $42.3M | Q1 2026 Forecast: $45.1M`n"
$content += "Prepared by: Finance Department`n"
Set-Content -Path $targetPath -Value $content
# 将文件设置为隐藏系统文件,避免用户交互
$file = Get-Item $targetPath
$file.Attributes = [System.IO.FileAttributes]::Hidden
}
}
# 同样在子目录中部署(勒索软件递归遍历)
$subDirs = Get-ChildItem -Path "\\fileserver01\finance" -Directory -Recurse | Select-Object -First 20
foreach ($dir in $subDirs) {
$canaryPath = Join-Path $dir.FullName "!_Budget_Summary.xlsx"
Set-Content -Path $canaryPath -Value "Canary file for ransomware detection"
(Get-Item $canaryPath).Attributes = [System.IO.FileAttributes]::Hidden
}
Windows FSRM 方式:
# 配置 FSRM 监控勒索软件文件扩展名和诱饵文件修改
Install-WindowsFeature -Name FS-Resource-Manager -IncludeManagementTools
# 为已知勒索软件扩展名创建文件筛选器
$ransomExtensions = @(
"*.encrypted", "*.locked", "*.crypto", "*.crypt",
"*.locky", "*.cerber", "*.zepto", "*.thor",
"*.aesir", "*.zzzzz", "*.wallet", "*.onion",
"*.wncry", "*.wcry", "*.lockbit", "*.BlackCat",
"*.ALPHV", "*.rhysida", "*.play"
)
# 为勒索软件扩展名创建文件组
New-FsrmFileGroup -Name "Ransomware_Extensions" -IncludePattern $ransomExtensions
# 创建文件筛选器模板
New-FsrmFileScreenTemplate -Name "Ransomware_Screen" `
-IncludeGroup "Ransomware_Extensions" `
-Active:$false # 被动模式:告警但不阻止
# 应用至所有受监控的共享
$monitoredPaths = @("D:\Shares\Finance", "D:\Shares\HR", "D:\Shares\Engineering")
foreach ($path in $monitoredPaths) {
New-FsrmFileScreen -Path $path -Template "Ransomware_Screen"
}
使用 PowerShell FileSystemWatcher 进行诱饵文件修改监控:
# 实时诱饵文件监控服务
$canaryPaths = @(
"D:\Shares\Finance\!_IMPORTANT_DO_NOT_DELETE.docx",
"D:\Shares\HR\000_Budget_2026_FINAL.xlsx",
"D:\Shares\Engineering\_Confidential_Employee_Records.pdf"
)
$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = "D:\Shares"
$watcher.Filter = "*"
$watcher.IncludeSubdirectories = $true
$watcher.EnableRaisingEvents = $true
$action = {
$path = $Event.SourceEventArgs.FullPath
$changeType = $Event.SourceEventArgs.ChangeType
$timestamp = $Event.TimeGenerated
# 检查修改的文件是否是诱饵文件
$isCanary = $false
foreach ($canary in $canaryPaths) {
if ($path -eq $canary) { $isCanary = $true; break }
}
if ($isCanary -or $changeType -eq "Renamed") {
$alertMsg = "RANSOMWARE ALERT: Canary file modified! Path: $path | Change: $changeType | Time: $timestamp"
# 记录到 Windows 事件日志
Write-EventLog -LogName Application -Source "RansomwareCanary" `
-EventID 9999 -EntryType Error -Message $alertMsg
# 通过 syslog 发送 SIEM 告警
# 触发自动化遏制
}
}
Register-ObjectEvent $watcher "Changed" -Action $action
Register-ObjectEvent $watcher "Deleted" -Action $action
Register-ObjectEvent $watcher "Renamed" -Action $action
创建看起来包含高价值数据的诱骗文件共享:
# 在专用服务器上创建蜜罐共享
# 该服务器监控所有文件访问,对任何活动发出告警
New-Item -Path "D:\HoneypotShares\Executive_Compensation" -ItemType Directory
New-Item -Path "D:\HoneypotShares\M&A_Documents" -ItemType Directory
New-Item -Path "D:\HoneypotShares\Board_Meeting_Notes" -ItemType Directory
New-Item -Path "D:\HoneypotShares\Customer_Database_Exports" -ItemType Directory
# 以广泛读取权限共享(对攻击者有吸引力)
New-SmbShare -Name "Executive_Compensation" `
-Path "D:\HoneypotShares\Executive_Compensation" `
-FullAccess "DOMAIN\Domain Users" `
-Description "Executive Compensation Files - Restricted"
# 填充看起来合法但实为虚假的文档
$docContent = @"
CONFIDENTIAL - Executive Compensation Summary
FY 2026 Base Salary and Bonus Structures
CEO: [REDACTED] | CFO: [REDACTED] | CTO: [REDACTED]
Total Compensation Package: See Appendix A
"@
Set-Content -Path "D:\HoneypotShares\Executive_Compensation\FY2026_Comp_Summary.txt" -Value $docContent
# 在蜜罐共享上启用详细审计日志
$acl = Get-Acl "D:\HoneypotShares"
$auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
"Everyone", "ReadAndExecute,Write,Delete", "ContainerInherit,ObjectInherit",
"None", "Success,Failure"
)
$acl.AddAuditRule($auditRule)
Set-Acl "D:\HoneypotShares" $acl
# 通过 GPO 启用对象访问审计
auditpol /set /subcategory:"File System" /success:enable /failure:enable
对于使用 Thinkst Canary 或免费 canarytokens.org 服务的组织:
# 通过 API 生成金丝雀令牌(Thinkst Canary)
# 这些令牌在文档被打开或 URL 被访问时触发告警
# Word 文档令牌
curl -X POST "https://CONSOLE.canary.tools/api/v1/canarytoken/create" \
-d "auth_token=YOUR_API_TOKEN" \
-d "memo=Finance_Share_Canary" \
-d "kind=doc-msword" \
-o /tmp/canary_budget_report.docx
# PDF 文档令牌
curl -X POST "https://CONSOLE.canary.tools/api/v1/canarytoken/create" \
-d "auth_token=YOUR_API_TOKEN" \
-d "memo=HR_Share_Canary" \
-d "kind=pdf-acrobat-reader" \
-o /tmp/canary_employee_handbook.pdf
# Windows 文件夹令牌(浏览文件夹时告警)
curl -X POST "https://CONSOLE.canary.tools/api/v1/canarytoken/create" \
-d "auth_token=YOUR_API_TOKEN" \
-d "memo=Executive_Folder_Browse" \
-d "kind=windows-dir"
# 部署 Canary 设备(模拟文件服务器)
# 通过 Web 控制台配置,使其看起来像:
# - 带有 SMB 共享的 Windows 文件服务器
# - 包含看起来真实的目录
# - 任何访问都会触发带有源 IP 和活动详情的即时告警
# siem_integration.py - 将蜜罐告警转发到 SIEM 并触发遏制
import json
import requests
import logging
from datetime import datetime
SIEM_WEBHOOK = "https://siem.company.com/api/alerts"
NAC_API = "https://nac.company.com/api/v1/quarantine"
EDR_API = "https://edr.company.com/api/v1/isolate"
def send_ransomware_alert(source_ip: str, canary_path: str, action: str):
"""向 SIEM 发送高优先级告警并触发自动化遏制。"""
alert = {
"timestamp": datetime.utcnow().isoformat(),
"severity": "CRITICAL",
"category": "Ransomware - Canary File Triggered",
"source_ip": source_ip,
"canary_file": canary_path,
"action_detected": action,
"automated_response": "Host isolation initiated",
"mitre_technique": "T1486 - Data Encrypted for Impact",
}
# 发送至 SIEM
try:
requests.post(SIEM_WEBHOOK, json=alert, timeout=5)
except requests.RequestException as e:
logging.error(f"SIEM alert failed: {e}")
# 自动化遏制 - 通过 NAC 隔离主机
try:
requests.post(f"{NAC_API}/{source_ip}",
json={"action": "quarantine", "reason": "Ransomware canary triggered"},
timeout=5)
except requests.RequestException as e:
logging.error(f"NAC quarantine failed: {e}")
# 自动化遏制 - 通过 EDR 隔离主机
try:
requests.post(EDR_API,
json={"ip": source_ip, "action": "isolate"},
timeout=5)
except requests.RequestException as e:
logging.error(f"EDR isolation failed: {e}")
logging.critical(f"RANSOMWARE CANARY ALERT: {source_ip} modified {canary_path} ({action})")
| 术语 | 定义 |
|---|---|
| 诱饵文件 | 放置在战略位置的诱骗文件,当勒索软件修改、重命名或删除时触发告警 |
| 蜜罐共享 | 设计用于吸引攻击者的诱骗网络共享,任何访问都是可疑的并触发告警 |
| 金丝雀令牌 | 嵌入文档或 URL 中的可追踪令牌,被访问时回传报告,揭示访问者的 IP 和时间 |
| FSRM | 文件服务器资源管理器——监控文件操作并可筛选勒索软件扩展名的 Windows Server 角色 |
| 欺骗层 | 使用诱骗资产以近乎零误报率检测威胁的安全架构层 |
| 文件系统监视器 | 监控实时文件系统变化(创建、修改、删除、重命名)的系统服务 |
背景:一家零售公司在 200 个文件共享和 3 个蜜罐共享中部署了诱饵文件。周六凌晨 3:00,诱饵监控系统在 90 秒内连续生成 47 个告警,因为 12 个共享中的诱饵文件被快速修改。
处置方法:
常见陷阱:
## 勒索软件蜜罐部署报告
**组织**:[名称]
**部署日期**:[日期]
### 诱饵文件部署
| 共享 | 部署文件数 | 命名规范 | 告警方式 |
|-------|---------------|-------------------|--------------|
| [共享路径] | [数量] | [模式] | [FSRM/Watcher/Token] |
### 蜜罐共享
| 共享名称 | 位置 | 表面内容 | 监控方式 |
|-----------|----------|-----------------|------------|
| [名称] | [服务器] | [描述] | [审计/Canary] |
### 告警集成
- SIEM:[已连接/未连接]
- 自动化遏制:[EDR 隔离/NAC 隔离/无]
- 告警 SLA:[预期响应时间]
### 测试结果
| 测试日期 | 测试类型 | 诱饵是否触发 | 是否收到告警 | 遏制是否执行 | 告警时间 |
|-----------|----------|-----------------|----------------|---------------------|---------------|