US 11,720,671 B2
Preventing ransomware from encrypting files on a target machine
Eldar Aharoni, Holon (IL); Vadim Goldstein, Rishon Lezion (IL); Mashav Sapir, Ness-Ziona (IL); and Jenny Kitaichik, Ramat-Gan (IL)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Nov. 17, 2022, as Appl. No. 17/989,602.
Application 17/989,602 is a continuation of application No. 17/228,554, filed on Apr. 12, 2021, granted, now 11,531,753.
Application 17/228,554 is a continuation of application No. 16/130,636, filed on Sep. 13, 2018, granted, now 11,010,469, issued on May 18, 2021.
Prior Publication US 2023/0078950 A1, Mar. 16, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/00 (2013.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01)
CPC G06F 21/554 (2013.01) [G06F 21/566 (2013.01); G06F 2221/034 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A system, comprising:
a processor configured to:
monitor file system activities on a computing device;
detect an unauthorized activity associated with a honeypot file or honeypot folder, wherein the honeypot file is a virtual file generated as a spoofed file system response using a filter driver or the honeypot folder is a virtual folder generated as the spoofed file system response using the filter driver, wherein the virtual file is dynamically generated using the filter driver with at least one of the following: a spoofed header, a spoofed time stamp, and a spoofed file size; and
perform an action based on a policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder, wherein the action comprises one or more of the following: kill a process based on the policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder associated with the process, or generate an alert based on the policy in response to the unauthorized activity associated with the honeypot file or honeypot folder; and
a memory coupled to the processor and configured to provide the processor with instructions.