Is macOS’s new XProtect behavioural security preparing to go live?

Re:Is macOS’s new XProtect behavioural security preparing to... by mattmcknight on Monday September 04, 2023 @10:51AM (#37381025)

Is there any software out there detecting an unusual volume of file encryption activities from a process that could indicate it is ransomware?

[ Parent | on HN ]

Re:Is macOS’s new XProtect behavioural security preparing to... by Terretta on Monday September 04, 2023 @11:49AM (#37381631)

“RansomWhere? is a utility with a simple goal; generically thwart OS X ransomware. It does so by identifying a commonality of essentially all ransomware; the creation of encrypted files.”

https://objective-see.org/products/ransomwhere.html

For a deep dive into this line of thinking, his post:

Towards Generic Ransomware Detection (04/20/2016) — https://objective-see.org/blog/blog_0x0F.html

Malwarebytes purchased an activity detecting product and claimed to offer this type of protection, though that marketing has become more generic now:

https://www.malwarebytes.com/cybersecurity/business/what-is-...

Given AV firms change hands and veer into dark patterns, forum posts like this one shouldn't recommend anything in particular as the ownership and policies can change overnight.

[ Parent | on HN ]

Re:Is macOS’s new XProtect behavioural security preparing to... by Unfrozen0688 on Monday September 04, 2023 @03:49PM (#37384248)

Sentinelone et al. places canary files that when encrypted flags for ransomware to central management.

[ Parent | on HN ]