--- title: "Huntress Service: Ransomware Canaries" description: Read about the value of Huntress' Ransomware Canaries service, a mechanism to deliver faster detection of a ransomware incident. image: https://www.huntress.com/hubfs/Blog%20-%20The%20State%20of%20the%20Dark%20Web/Ransomware-Canaries-blog-header.jpg --- [Skip to content](https://3911692.hs-sites.com/blog/huntress-service-ransomware-canaries#main-content) [Close ](https://3911692.hs-sites.com/blog/huntress-service-ransomware-canaries#) [![Huntress Logo Wide Teal](https://3911692.hs-sites.com/hs-fs/hubfs/Huntress%20Logo%20Wide%20Teal.png?width=193&height=41&name=Huntress%20Logo%20Wide%20Teal.png)](https://www.huntress.com) [Annie Ballew](https://3911692.hs-sites.com/blog/author/annie-ballew) 06.24.2020 4 min read # Huntress Service: Ransomware Canaries [Previous Post ](https://3911692.hs-sites.com/blog/evolving-the-hunt) [Next Post ](https://3911692.hs-sites.com/blog/huntress-service-external-recon) Share on Twitter Share on LinkedIn Share on Facebook Share on Reddit From CryptoLocker to Locky to Sodinokibi to Maze, ransomware has been a staple in the hacker-verse for a long time. For defenders, the solution to ransomware usually consists of robust incident response and containment, followed by a sturdy backup and recovery plan. But how do you know when to activate this plan? And what happens when attackers find [new approaches](https://www.crn.com/news/managed-services/cognizant-some-employee-email-access-lost-after-maze-attack)? ## **What Do Ransomware Canaries Do?** [Ransomware Canaries](https://3911692.hs-sites.com/platform/ransomware-canaries) are a mechanism to deliver faster detection of a ransomware incident. Imagine if you woke up at *7am on Monday morning* to a flurry of phone calls from your customer about a ransomware incident. You have your incident response playbook in hand and your backup methods ready to go, but executing all the moving pieces still takes time — draining away productive hours at the start of the work week. What if you had been alerted to the incident on Friday night when it started encrypting? You would have an extra 60 hours to contain, respond, and remediate. Detecting ransomware early accelerates recovery time and shows your clients you’re already on top of the response plan. ## **What is a Ransomware Canary?** A ransomware canary is nothing more than a file that sits quietly on an endpoint and is monitored for changes. If the file is encrypted due to a ransomware outbreak, this signifies a change to the file and triggers an alert so that investigation and response can begin. The idea comes from the age old “canary in the coal mine” where miners would bring actual [canaries](https://en.wikipedia.org/wiki/Sentinel_species) into the mines as early warning signs of carbon monoxide fumes. ![mine using a canary](https://3911692.hs-sites.com/hs-fs/hubfs/mine%20using%20a%20canary.jpg?width=1400&name=mine%20using%20a%20canary.jpg) ## **How Does It Work?** The Huntress agent will simply push out unique canary files onto the endpoint. When changes to the ransomware canary files are detected, it sets off an alert to [our ThreatOps team](https://3911692.hs-sites.com/platform/threatops) to kickstart an investigation. By marrying this early detection mechanism with ThreatOps automation and intelligence, we are able to alert quickly and weed out potential false positives (changes to these files may not always relate to encryption by ransomware). If a ThreatOps investigation concludes that ransomware is indeed the cause, a critical incident ticket is sent identifying which endpoints are impacted. ## **Aren’t My Backups Enough? Why Do I Need This?** Backups are a critical component to any recovery plan, but it helps to know when to actually activate the recovery. At the same time, threats evolve; the ransomware of yesterday is not the ransomware of today. With backup plans essentially voiding their ability to make money, we’re now seeing how bad actors not only hold data for ransom, but also exfiltrate copies in order to [extort](https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/) their victims — threatening to unleash sensitive documents to the dark web when payment is not made. At Huntress, we look at how things have been done before and how it can be done better. One of the interesting aspects to Huntress’ approach is the implementation of *unique canary files*. Each canary contains an embedded QR code unique to the user profile; that way *if* data is released onto the dark web that includes the ransomware canary file, we can trace back to the source of the exfiltrated data. ![Huntress Ransomware Canary File](https://3911692.hs-sites.com/hs-fs/hubfs/Huntress%20Ransomware%20Canary%20File.png?width=1400&name=Huntress%20Ransomware%20Canary%20File.png) ## **Why Detect and Not Prevent?** Right now, Ransomware Canaries *specifically *look at tackling the detection of ransomware and enabling faster response. With a “crawl, walk, run” approach, Ransomware Canaries establish a threat research foundation to identify new holes that need to be addressed to improve prevention. We know that perfect prevention does not exist* — *the “cat and mouse” game between attackers and defenders is and always will be ongoing. Even though Ransomware Canaries do not directly offer prevention, it offers intelligence to inform actionable steps towards better prevention. ## **Why This Approach to Ransomware?** When we take a step back and *oversimplify* how security tools work, they usually require two things: A) the right visibility to monitor for bad behavior and B) the training to recognize when it’s looking at something bad. Think about it this way: If the threat is happening behind you, you can’t see it to respond. If the threat is happening right in front of you but you don’t recognize it’s bad, then simply seeing it does no good. Each layer in the security stack is merely a different view of the IT environment with a different set of training. This is why ‘stacking’ multiple tools together has been one of the fundamental principles in cybersecurity. Let’s relate this to ransomware. There are many tools that can potentially detect ransomware but may have a very narrow view. For example, a tool may only be monitoring files or file behavior. So if the ransomware is “fileless” or uses some other mechanism not monitored by the endpoint security stack, then it can’t see it to respond. Even with persistence, there are instances where ransomware simply does not establish a foothold. There are many solutions commonly stacked together to address prevention — from DNS filtering to endpoint file monitoring — but not as many that focus on detection and response. We’ve chosen to start out with detection and believe this will give us the research and ammunition to help guide new prevention solutions. ## **What’s Next?** ## **[![Ransomware Canaries](https://no-cache.hubspot.com/cta/default/3911692/611ee655-e1ac-4365-8c14-132d503181ab.png)](https://cta-redirect.hubspot.com/cta/redirect/3911692/611ee655-e1ac-4365-8c14-132d503181ab)** There is a lot you can do with early detection. Early detection can potentially be combined with a response mechanism such as kickstarting backup recovery. And as ransomware continues to change, the beauty of the Huntress Security Platform is that it allows us to pivot right alongside these hackers — meeting and beating them wherever they go. For more techie stuff, check out our support articles here: - [Ransomware Canaries: End User](https://support.huntress.io/article/135-ransomware-canaries) - [Ransomware Canaries: Technical Details](https://support.huntress.io/article/136-ransomware-canaries-technical-details) ![avatar](https://3911692.hs-sites.com/hs-fs/hubfs/Annie_headshot.jpg?width=290&height=290&name=Annie_headshot.jpg) #### [Annie Ballew](https://3911692.hs-sites.com/blog/author/annie-ballew) Security Maven. Cake Lover. Senior Product Manager at Huntress. ## You May Also Like [ Matt Kiely 12.27.2023 15 min read ## Combating Emerging Microsoft 365 Tradecraft: Initial Access Threats evolve, and so does Huntress. Let’s talk about evolving our approach to hitting ... Start Reading ](https://3911692.hs-sites.com/blog/combating-emerging-microsoft-365-tradecraft-initial-access) [ James O’Leary 12.20.2023 2 min read ## Effortless Phishing Simulations Now Part of Huntress Security Awareness Training Read about our newest addition to Huntress SAT, Managed Phishing, offering you ... Start Reading ](https://3911692.hs-sites.com/blog/effortless-phishing-simulations-now-part-of-huntress-security-awareness-training) [ Kyle Hanslovan 12.6.2023 7 min read ## Huntress MDR for Microsoft 365 Update An update on our MDR for Microsoft 365 product, some recent improvements, and what fixes ... Start Reading ](https://3911692.hs-sites.com/blog/huntress-mdr-for-microsoft-365-update) [![Huntress](https://3911692.hs-sites.com/hubfs/Huntress-1.svg)](https://www.huntress.com) Deploy managed detection and response for endpoints and identities in minutes. [LinkedIn ](https://www.linkedin.com/company/huntress-labs/) [Twitter ](https://twitter.com/huntresslabs) [Facebook ](https://www.facebook.com/huntresslabs) [YouTube ](https://www.youtube.com/c/Huntress/featured) © 2026 Huntress - All rights reserved