Skip to content

Instantly share code, notes, and snippets.


Agent Cobra Bubbles thatguy031415

View GitHub Profile

Keybase proof

I hereby claim:

To claim this, I am signing this object:

thatguy031415 / ransomcanary.ps1
Created Feb 3, 2017
Ransomware canary file script in powershell
View ransomcanary.ps1
Powershell script to create and monitor a ransomware canary file;
If the canary is modified, the script will notify the user, log the data,
create an entry in the event log, and stop the workstation service,
crippling the machine's ability to map or access network drives.
Modified from a script found at
$DirPath = "C:\Temp\"