Stop ransomware and get your files back
It is Friday night. Malware starts to encrypt your quotes and contracts. The ransomware guard in SecTepe Endpoint notices after a few files. It stops the program and keeps a snapshot ready. You use it to bring back the files that were hit. The guard is an optional module for Windows and Linux.
Request a demoHow the guard spots encryption
Ransomwareencrypts your files and demands a ransom. The guard watches for two signs.
Canary files
In each watched folder, the guard creates a hidden folder with decoy files. They look like normal documents. No person and no normal program has a reason to change them. If a program writes to them anyway, the guard fires at once.
Mass encryption
The guard watches every program that writes files. Does it change many files in several folders within seconds? Do the files look like random data afterwards? Do they carry typical ransomware file endings? Does the program leave a ransom note? Then it counts as suspicious. You can adjust the limits.
Fewer false alarms through exceptions
A backup program also writes many files in a short time. That is why there is an exception list. The guard only reports known backup, archive and sync programs as suspicious. It does not stop them. On Linux, it skips cache and package folders entirely.
Three modes: you decide how hard it acts
You pick the mode per device. The guard may act at once, without a second approval. This is the only exception to the four-eyes rule in SecTepe Endpoint. With ransomware, every second counts.
Report only
The guard writes down which program it would have stopped. Nothing is stopped. This way you first find exceptions, such as your backup software.
Stop the process
This is the default once you switch the guard on. It stops the program and every program it started. The program file goes to quarantine.
Stop and isolate
On top of that, it cuts the device off the network. Only the link to the platform stays open. So the attack cannot spread to shared folders.
The guard never stops key parts of the operating system or SecTepe Endpoint itself. Lifting an isolation always needs approval from a second person.
Snapshots: the way back to your files
A snapshot is a backup copy of your files at one point in time. The guard takes one every 30 minutes. Each hit adds another one right away. It keeps up to 48 regular and 20 hit snapshots.
On Windows, it uses the Windows shadow copies. On Linux, it depends on the file system. If that has no snapshots, you can switch on a copy-based option.
Restore to a separate folder first
You bring files back from the console. This action needs a second approval. The files land in a separate folder first. So you can check in peace that everything is right. The guard only overwrites your current files if you clearly ask for it.
Protecting Windows shadow copies
Many attackers delete the shadow copies first. Then there is no way back. The guard spots the commands for this. It stops the program that runs them and the program that started it. An admin who types such a command by hand will lose their window. You can turn this reaction off. The alert stays.
Folder protection as a second layer
On Windows, you also get folder protection. Only trusted programs may then write to protected folders. Windows enforces this block itself. By default, it only logs. Folder protection needs the built-in Windows antivirus to be running.
To see how all modules work together, read our glossary entry onendpoint detection & response.
FAQ on ransomware protection
- Does ransomware protection stop every attack?
- No, there is no guarantee. The guard steps in once the first files are hit. That is why snapshots are part of it. You use them to bring back the first encrypted files.
- Will it get in the way of my backups?
- It is prepared for that. Known backup, archive and sync programs are on an exception list. The guard only reports them as suspicious and does not stop them. If you run software that is not on the list yet, start with “report only”.
- How much disk space do the snapshots need on Windows?
- Space for shadow copies is capped at a share of the drive, 15 percent by default. Once the cap is reached, the oldest copies drop out. With less than 10 percent free space, the guard takes no new copy and reports this.
- Do I still need a backup?
- Yes. The snapshots sit on the same device. They help when an attack is stopped early. They do not replace a separate backup. A program with full admin rights can still destroy shadow copies. The guard only makes this much harder.
Test ransomware protection in your setup
We show you how the guard fires and how you get files back.
Request a demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.