1

I’m trying make a script to monitor if a file name is changing within a specific folder, and then if true to trigger the action of shutting down that device.

The whole idea is to be one step ahead of the cryptolockers.

If they will be still able to access our network and to run the encryption software then when the name of the file will change the device will just shut down.

Did anyone already run a script like that? Any advice is welcome (I don't know much about writing a script)

Thanks!

Post update

Indeed the SO will be Windows. The whole ideea is to set this script on the shared servers and into the important folders to create a folder which should contain a specific file. That file will be monitored thrugh the script, and at any moment when the name of that file will be modified, the action should be $shutdown.exe /f /r /t 00 So the script will only monitor one file (let's say file.xyz) from a one folder, and as long as the file name not change, the script should just run in a loop. And yes the script should run on a timer to regularly check the specific file. To apply the script on the target servers - we are using N-Central - and we can deploy the script from N-Central.

5
  • Could you be more specific about the OS where you want this software to be running?
    – jcbermu
    Oct 6, 2016 at 9:53
  • I guess the OS would be Windows (main target of the cryptolockers). Have you already thought about how to shut down "the device". For example Locky will also scan and corrupt unmapped network locations. So in that case the whole network access should be disabled because you can't "shut down" a remote computer easily.
    – Rik
    Oct 6, 2016 at 9:56
  • And have you thought about what filename you are going to watch (of what file). You can't watch them all for changes because that would trigger the script almost every second (for your own filename changes and that of Windows itself). And if you just pick a file which doesn't change you're almost always too late. These cryptolockers will already have encrypted half your drive (or network location). It's better to just have a good scanner (and policy to not just run everything without checking it).
    – Rik
    Oct 6, 2016 at 10:03
  • Please note that superuser.com is not a free script/code writing service. If you tell us what you have tried so far (include the scripts/code you are already using) and where you are stuck then we can try to help with specific problems. You should also read How do I ask a good question?.
    – DavidPostill
    Oct 16, 2016 at 8:07
  • Consider just getting actual software designed to protect you, which would be much more reliable. Something like WinAntiRansom from the WinPatrol people.
    – fixer1234
    Oct 17, 2016 at 6:37

1 Answer 1

0

The .NET Framework provides a FileSystemWatcher class that fires events when certain changes are made in the file system. I have used it to write a file transfer service for a work project and it works well. Here's a tutorial for a 'Folder Watcher Service' that should give you an idea of what it can do and whether you want to go down that route.

As far as I know, the other option is to write a script that runs on a timer or infinite loop and regularly checks that files in a specific folder looking for changes. This could be written in any number of languages but would be a less elegant solution.

4
  • Hey T_Bacon, Tx for your reaction. Indeed what i was thinking about it is the script that runs on a timer or infinite loop. We are now in the tasting stage and that sims like a easy solution. Does it happen maybe for you to still have such a script, so I can start from there? Oct 6, 2016 at 14:48
  • @CornelStirbu - I'm afraid I haven't got a script that loops through the files in a directory. It shouldn't be too difficult to implement, I'm sure there are some good examples on the web if you search for them.
    – T_Bacon
    Oct 6, 2016 at 15:52
  • There are lots of examples. Here is my first hit in Google: superuser.com/questions/226828/… But I still think this is the wrong approach because when this script triggers the damage is almost certainly already done.
    – Rik
    Oct 6, 2016 at 16:12
  • @ rik - I got your point about our approach for this problem. We can for example to make 2 or 3 of this folders that should be always monitored by the script. One to be the first in the list of the sharing folders (.Folder) one to be the last (zFolder) and when the cryptolock strike that will trigger the shutdown to limit de damage. We are using Veeam Backup anyway, but if the attack it is happening in holiday or so, sometimes we can't go back far enough... Oct 7, 2016 at 6:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .