Ransomware Decoy File Deployer
Plants tripwire decoy files that alert you when ransomware starts encrypting a folder.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent to set up 'canary' or honeytoken files: realistic-looking decoy documents placed in folders such as file shares, desktops and finance or HR directories. A file system watcher monitors them, and if anything modifies, renames or deletes one, the agent flags a likely ransomware event so a security team can respond quickly. It also includes a Python helper script (agent.py) that generates and monitors canary files, using SHA-256 hashes to detect changes and a list of known ransomware file extensions and ransom note names to recognise suspicious activity.
Great for
- Security or IT teams wanting an early-warning layer on file servers or endpoints
- Defenders who want low-false-positive alerts that complement EDR and backups
- Teams testing whether their ransomware alerting pipeline actually fires
Skip it if
- Use as a sole ransomware defense: it only detects, it does not prevent attacks, so backups, EDR and access controls are still required
- Unsupervised deployment on production systems without admin review: the script and watcher need elevated access and can trigger automated responses such as killing processes or isolating networks, which could disrupt business if misconfigured
Try asking
- “Set up decoy canary files across our file shares and alert the SOC if they are modified”
- “Create a Python watcher using watchdog that flags renamed canary files with ransomware extensions”
- “Help me design a canary placement strategy for our finance and HR shares”
- “Write a test plan to verify our canary alerts fire within 30 seconds”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
deploying-decoy-files-for-ransomware-detection.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip deploying-decoy-files-for-ransomware-detection.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip deploying-decoy-files-for-ransomware-detection.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/agent.py and the automated response actions before running anything, and start in a test environment
- Exclude backup agents and AV scanners from alerts to reduce false positives, as the skill recommends
- Keep the canary names and locations confidential so attackers cannot easily avoid or tamper with them
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.