Ransomware Detection for Windows and Linux using ETW and eBPF
I build ET Ducky, an RMM that reads the kernel event stream on each endpoint. We launch on Product Hunt on Tuesday, September 29, and today I'm writing about the behavioral rule engine. Every managed agent runs thirteen built-in rules against its own kernel event stream. ETW supplies the events on Windows and eBPF tracepoints supply them on Linux. We funnel both into one event format, so each…
ET Ducky, a response management system, has launched on Product Hunt, offering ransomware detection for Windows and Linux systems. Each managed agent within the system runs thirteen built-in rules against its own kernel event stream, with ETW providing events on Windows and eBPF tracepoints supplying them on Linux. Both event streams are funneled into a unified format, ensuring each rule has a consistent definition that can trigger on either operating system.
The engine runs on the same thread that delivers events, preventing any rule from blocking. To minimize false negatives, the engine is optimized for false positives. Various per-process cooldowns are implemented to suppress repeated firings of the same pattern, and the dashboard deduplicates duplicate firings. The rule set includes mass-file-rename, which triggers when 25 or more files are renamed with ransomware extensions within 60 seconds, and file-encryption-sweep, which activates when 20 or more files receive the same destination extension within 30 seconds.
Additionally, policy changes can adjust these windows. Other rules include mass-file-access, which fires when 200 distinct paths across three user-data root directories are accessed within 5 seconds, and shadow-copy-deletion and ransom-note-pattern, both of which activate upon a single match. The ransomware kill-chain rule is the only agent-side rule that evaluates the engine's output rather than raw events.
It triggers a Critical alert when two or more of shadow-copy-deletion, mass-file-rename, and ransom-note-pattern occur on the same process within five minutes, referencing the component detections in its evidence list. A limit on Linux ensures that both the old and new file names are available for rename events. Importantly, ET Ducky serves as a behavioral security monitoring tool, not an antivirus engine, and does not replace existing antivirus solutions.
The complete rule set, thresholds, and evidence formats are detailed in the original post at https://etducky.com/blog/behavioral-security-monitoring-rules.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
