Skip to content

Instantly share code, notes, and snippets.

Avatar

Agent Cobra Bubbles thatguy031415

View GitHub Profile
View keybase.md

Keybase proof

I hereby claim:

To claim this, I am signing this object:

@thatguy031415
thatguy031415 / ransomcanary.ps1
Created Feb 3, 2017
Ransomware canary file script in powershell
View ransomcanary.ps1
<#
Powershell script to create and monitor a ransomware canary file;
If the canary is modified, the script will notify the user, log the data,
create an entry in the event log, and stop the workstation service,
crippling the machine's ability to map or access network drives.
Modified from a script found at freeforensics.org
#>
$DirPath = "C:\Temp\"