Skip to main content
Tier One
Critical

Ransomware canary file modified on the engineering share

A-1060

00:00time on this alert, target 5 minutes

Back to queue

Alert details

Source
EDR
Detection rule
EDR-RANSOM-CANARY-001
Affected user
l.nowak
Affected host
SRV-FILE-03
Source IP
—
First seen
2026-07-24T16:34:00Z

Why this fired, in plain English

A decoy file that nobody should ever touch was renamed and encrypted, which usually means ransomware is running.

Suggested playbook

Malware detection on an endpoint

  1. 1. Read the action field first: blocked/quarantined changes urgency dramatically versus alert_only.
  2. 2. Identify the process path. AppData, Temp and Users\Public are common malware locations.
  3. 3. Check the parent process — Office apps spawning shells is abnormal.
  4. 4. Look up the file hash for a verdict and first-seen date.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 4 events.

  1. Guided hint: this line matters

    ts=2026-07-24T16:33:02Z host=SRV-FILE-03 sensor=edr event=file_rename path="\\\\SRV-FILE-03\\CAD-Designs\\_aaa_canary.docx" new_path="_aaa_canary.docx.lkfz" user="l.nowak"

    A strange new file extension appended to existing files is the fingerprint of an encryption run.

  2. Guided hint: this line matters

    ts=2026-07-24T16:33:05Z host=SRV-FILE-03 sensor=edr event=mass_file_modify user="l.nowak" file_count=3271 rate_per_min=1830 extension_added=".lkfz"

    3,271 files changed at 1,830 per minute is far beyond human speed.

  3. Guided hint: this line matters

    ts=2026-07-24T16:33:09Z host=SRV-FILE-03 EventID=4688 process_name="C:\\Users\\Public\\lkfz.exe" parent_process="wmiprvse.exe" cmdline="lkfz.exe -enc -path \\\\SRV-FILE-03\\CAD-Designs -nodel"

  4. Guided hint: this line matters

    ts=2026-07-24T16:33:44Z host=SRV-FILE-03 sensor=edr event=shadow_copy_delete cmdline="vssadmin.exe delete shadows /all /quiet"

    Deleting shadow copies removes Windows' own backups so victims cannot roll back.

Related events

The order things happened in.

  1. 16:33Z

    Canary file encrypted

  2. 16:33Z

    3,271 files encrypted on the CAD share

  3. 16:33Z

    Volume shadow copies deleted

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.