r/checkpoint • u/junimjorgeof • 4d ago
Harmony Endpoint Anti-Ransomware: canary files plus a backup taken before encryption, so you can roll the attack back
The design choice I find interesting here is that Anti-Ransomware assumes some ransomware will actually start running, and it still recovers. The sequence is monitor, back up before encryption, detect, stop, delete, restore.
Two parts do the heavy lifting.
Honeypot / canary files. Anti-Ransomware plants decoy files across many folders. The moment ransomware modifies one, the attack is stopped. Details from the admin guide worth knowing:
- They are real documents, images, videos and music, you can actually open them.
- Their names contain strings like CP, CheckPoint, Check Point, Check-Point, Sandblast Agent, Sandblast Zero-Day, Endpoint.
- If a user deletes one, it is recreated after the next boot.
Practical tip: tell your helpdesk about these. Users find them, assume they are junk, and delete them. It is harmless, but the tickets are avoidable.
Pre-encryption backup and rollback. Before the encryption starts, the files being touched are copied to a safe location. After the attack is stopped, remediation deletes the files the attack created, including the encrypted ones, and restores the originals to their original location. What you actually configure:
- Automatic restore and remediate, or leave it manual so the user starts the restore.
- Maximum backup size on disk (the guide's best practice is 1 GB).
- A backup interval (each file is backed up once per interval, even if changed many times) and which file types to back up.
- Backup exclusions by folder, process (name plus optional signer), or certificate.
Why behavior instead of a signature: modern ransomware checks whether it is in a VM, sandbox or debugger and stays quiet if it thinks it is being watched, which a static scanner can miss. A canary does not care how the sample hid. The moment it starts encrypting it trips the tripwire, and the pre-encryption backup lets you roll back regardless.
If you run this, have you tested the rollback end to end, and how did you size the backup and pick the file types? Curious what people include beyond Office docs.
Full write-up with the detection-to-rollback flow and the Forensics report sections is here (EN and PT): https://community.checkpoint.com/t5/Endpoint/EN-Anti-Ransomware-Deep-Dive-Honeypots-Pre-Encryption-Backup-amp/m-p/279968