Ransomware Canary File Deployer
Plants decoy files that alert you when ransomware or an intruder touches them.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can set up decoy files (named like passwords or financial reports) in folders that ransomware tends to scan first, then watch them with a Python library called watchdog. Any read, change, rename, or delete of a decoy triggers alerts by email, Slack, or syslog, giving an early warning before real data is encrypted. It is a detection layer, not a replacement for antivirus, backups, or segmentation.
Great for
- Security or IT staff adding early-warning detection to file servers or NAS devices
- Teams that cannot install an endpoint detection agent on some systems
- Students or testers practicing ransomware incident response in a lab
Skip it if
- Production protection on its own: canaries only detect activity after it starts, so backups and endpoint controls are still needed
- Environments where the decoys could be mistaken for real credentials and cause confusion or misuse, unless the team plans for that
- Non-technical users without access to admin rights, SMTP or Slack credentials, and a place to run a long-lived Python process
Try asking
- “Set up ransomware canary files in our finance share and alert the security team by Slack if they are touched”
- “Write a Python watchdog monitor that sends syslog alerts to our SIEM when a decoy file is modified”
- “Simulate ransomware behaviour against the canary files to test that our alert pipeline fires”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
deploying-ransomware-canary-files.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip deploying-ransomware-canary-files.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip deploying-ransomware-canary-files.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/agent.py before running; it writes a canary_monitor.log file and places files in directories you specify.
- Use clearly fake, non-sensitive content and avoid embedding real-looking production passwords in decoys; the sample template includes a credential-looking string that should be replaced.
- Test in a non-production share first and confirm alerts reach every channel before relying on them.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.