US 11,947,667 B2
Preventing ransomware from encrypting files on a target machine
Eldar Aharoni, Holon (IL); Vadim Goldstein, Rishon Lezion (IL); Mashav Sapir, Ness-Ziona (IL); and Jenny Kitaichik, Ramat-Gan (IL)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Jun. 14, 2023, as Appl. No. 18/209,897.
Application 18/209,897 is a continuation of application No. 17/989,602, filed on Nov. 17, 2022, granted, now 11,720,671.
Application 17/989,602 is a continuation of application No. 17/228,554, filed on Apr. 12, 2021, granted, now 11,531,753, issued on Dec. 20, 2022.
Application 17/228,554 is a continuation of application No. 16/130,636, filed on Sep. 13, 2018, granted, now 11,010,469, issued on May 18, 2021.
Prior Publication US 2023/0325499 A1, Oct. 12, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/00 (2013.01); G06F 21/55 (2013.01); G06F 21/56 (2013.01)
CPC G06F 21/554 (2013.01) [G06F 21/566 (2013.01); G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system, comprising:
a processor configured to:
monitor file system activities on a computing device;
detect an unauthorized activity associated with a honeypot file or a honeypot folder, wherein the honeypot file is a virtual file generated as a spoofed file system response using a filter driver or the honeypot folder is a virtual folder generated as the spoofed file system response using the filter driver, wherein the virtual file is dynamically generated with a spoofed header, a spoofed time stamp, and a spoofed file size using the filter driver, and wherein the virtual folder is not generated for the spoofed file system in response to legitimate directory activities based on an endpoint agent executing on the computing device determining that a return address associated with a request to access a protected directory is associated with a predetermined set of shell related Dynamic Link Libraries (DLLs);
perform an action based on a policy in response to the unauthorized activity associated with the honeypot file or the honeypot folder; and
a memory coupled to the processor and configured to provide the processor with instructions.