Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Endpoint Standard: What are these $XXXXXXXX files found on a computer?

Endpoint Standard: What are these $XXXXXXXX files found on a computer?

Environment

  • Endpoint Standard (formerly CB Defense) Sensor: Version 3.0 and higher
  • Microsoft Windows: All Supported Versions
  • Apple Mac OS: All Supported Versions

Question

Why are there files (doc, jpg, xls, pptx) found in various folders on my system named $XXXXXXXX?

Answer

With version 3.x of the Endpoint Standard sensor, we introduced "Canary Files" into the sensor. The sensor seeds and monitors these files in various locations on the system to help in the detection of ransomware like activity on the endpoint.

Additional Notes

  • Canary files are automatically deployed on version 3.x sensor in any policy
  • There is currently no way to disable canary files
  • If a canary file is deleted, the sensor will deploy a replacement in the same or different location on the system

Related Content


Was this article helpful? Yes No
100% helpful (2/2)
Article Information
Author:
Creation Date:
‎03-11-2019
Views:
7929
Contributors