Fighting Ransomware with Real-Time Detection

A group of security experts has unveiled an exciting new tool on GitHub, engineered to battle ransomware directly within Windows. Known as “Sanctum,” this tool is a part of a broader Endpoint Detection and Response (EDR) framework. It taps into Windows Minifilters to spot and stop ransomware before crucial data is lost forever.

Sanctum utilizes a Windows feature called a “filter driver,” which acts like a security checkpoint between your apps and hard drive. As explained by researcher 0xflux, it’s the perfect “chokepoint” for monitoring all file actions—like creating, writing, or renaming files—making it possible to catch potential threats early.

Originally imagined in Rust for its safety benefits, Sanctum was developed in C because Rust bindings for Windows filter drivers are unavailable. It works by setting up “callbacks,” or alerts, for specific file actions.

Key Events Monitored by Sanctum

• IRP_MJ_CREATE: This event tracks when a process opens a file. Frequent requests to create, modify, or delete might indicate ransomware readying encryption.
• IRP_MJ_SET_INFORMATION: This detects changes to file metadata, such as renaming. Ransomware often adds extensions like .HLJkNskOq when encrypting files.

If a suspect renaming event occurs, Sanctum examines the filename using FltGetFileNameInformation and checks it against known malicious extensions. When a match is found, it blocks the operation and identifies the source process, providing clear alerts like: “PID 1234 from suspicious.exe is attempting to rename your documents!”

Currently, Sanctum logs these events for telemetry, helping security teams respond quickly. Future updates may include monitoring file “entropy” to detect encryption in real time and possibly freezing malicious threads to stop attacks in their tracks. This kernel-level approach outpaces typical antivirus solutions, working at machine speed with full file visibility.

Sanctum shows that kernel defenses can outperform standard user-space security methods. For more information, the project is available on GitHub and fluxsec.red, perfect for cybersecurity enthusiasts looking to upgrade their EDR arsenal.

Stay updated with more cybersecurity insights by following us on Google News, LinkedIn, and X.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.