From asi
Detects ransomware encryption activity in real-time using entropy analysis, file I/O monitoring, and behavioral heuristics. Identifies mass file modifications, entropy spikes, and suspicious processes on endpoints and file servers.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- Building or tuning a behavioral detection layer for ransomware that catches unknown/zero-day variants
Detects ransomware encryption in real-time using entropy analysis, file I/O monitoring, and process heuristics. Spots mass file changes, entropy spikes for zero-day defenses on endpoints.
Detects pre-encryption ransomware precursors in network traffic using Zeek, Suricata, Arkime, SIEM rules, and threat intel. For building detection rules, monitoring initial access, and incident response.
Analyzes ransomware encryption algorithms like AES, RSA, ChaCha20; evaluates key management, decryption feasibility, and implementation weaknesses for recovery.
Share bugs, ideas, or general feedback.
Do not use entropy analysis alone as the only detection signal. Compressed files (ZIP, JPEG, MP4) naturally have high entropy and will cause false positives. Always combine entropy with behavioral signals like I/O rate and file rename patterns.
watchdog and psutil librariesCalculate normal entropy ranges for files in the environment:
Entropy Baselines by File Type:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
File Type Normal Entropy Encrypted Entropy
.docx 3.5 - 6.5 7.8 - 8.0
.xlsx 4.0 - 6.8 7.8 - 8.0
.pdf 5.0 - 7.2 7.8 - 8.0
.txt 2.0 - 5.0 7.8 - 8.0
.csv 2.0 - 5.5 7.8 - 8.0
.sql 2.5 - 5.0 7.8 - 8.0
.jpg/.png 7.0 - 7.9 7.9 - 8.0 (hard to distinguish)
.zip/.7z 7.5 - 8.0 7.9 - 8.0 (hard to distinguish)
Key insight: Text-based files show the largest entropy jump when encrypted,
making them the best candidates for entropy-based detection.
Monitor file writes and calculate entropy of new content:
import math
from collections import Counter
def shannon_entropy(data):
"""Calculate Shannon entropy of byte data (0.0 to 8.0 scale)."""
if not data:
return 0.0
freq = Counter(data)
length = len(data)
return -sum((c / length) * math.log2(c / length) for c in freq.values())
def is_encryption_entropy(data, threshold=7.5):
"""Check if data entropy indicates encryption."""
entropy = shannon_entropy(data)
return entropy >= threshold, entropy
Track process-level file operations for ransomware patterns:
Ransomware I/O Behavior Signatures:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Rapid sequential file modification:
- >20 files modified per minute by single process
- Read original → Write encrypted → Rename with new extension
- Pattern: CreateFile → ReadFile → WriteFile → CloseHandle → MoveFile
2. File extension changes:
- Original: report.docx → Encrypted: report.docx.locked
- Many extensions changed within short time window
3. Ransom note creation:
- Same text file (README.txt, DECRYPT.html) created in multiple directories
- Created immediately after file encryption in each directory
4. Shadow copy deletion:
- vssadmin.exe delete shadows /all /quiet
- wmic.exe shadowcopy delete
- PowerShell: Get-WmiObject Win32_Shadowcopy | Remove-WmiObject
5. Entropy spike pattern:
- File read: entropy 3.5 (normal document)
- File write: entropy 7.9 (encrypted content)
- Delta > 3.0 is strong ransomware indicator
Combine multiple signals into a composite ransomware score:
def calculate_ransomware_score(process_metrics):
"""Score process behavior for ransomware likelihood (0-100)."""
score = 0
# High file modification rate
files_per_min = process_metrics.get("files_modified_per_minute", 0)
if files_per_min > 50:
score += 30
elif files_per_min > 20:
score += 15
# Entropy increase in written files
avg_entropy_delta = process_metrics.get("avg_entropy_delta", 0)
if avg_entropy_delta > 3.0:
score += 30
elif avg_entropy_delta > 2.0:
score += 15
# File extension changes
extension_changes = process_metrics.get("extension_changes", 0)
if extension_changes > 10:
score += 20
elif extension_changes > 3:
score += 10
# Ransom note creation
if process_metrics.get("ransom_note_created", False):
score += 20
return min(score, 100)
Set detection thresholds and automated containment actions:
Detection Thresholds:
━━━━━━━━━━━━━━━━━━━━
Score 0-25: INFORMATIONAL - Log only, no action
Score 25-50: LOW - Alert SOC for investigation
Score 50-75: HIGH - Alert SOC, suspend process, snapshot VM
Score 75-100: CRITICAL - Kill process, isolate endpoint, alert IR team
Automated Response Actions:
- Suspend/kill the encrypting process
- Disable network adapter to prevent lateral movement
- Create volume shadow copy snapshot before further damage
- Capture process memory dump for forensic analysis
- Send SIEM alert with process details, affected files, and timeline
| Term | Definition |
|---|---|
| Shannon Entropy | Mathematical measure of randomness in data (0-8 for bytes); encrypted data approaches 8.0, while text files are typically 2-5 |
| Differential Entropy | The change in entropy between a file's original and modified content; a spike indicates encryption |
| I/O Rate Anomaly | Abnormally high rate of file read/write operations by a single process, characteristic of bulk encryption |
| Behavioral Scoring | Combining multiple weak signals (entropy, I/O rate, file renames) into a composite confidence score |
| Entropy Evasion | Techniques used by advanced ransomware to defeat entropy detection, such as Base64 encoding output or partial encryption |