Software that monitors file changes and sends email alerts

[ashman]

Looking for a program I can install on a Windows (2008R2) file server that will monitor file changes, so if a crypto malware or ransomware attach occurs and starts encrypting files at fast rate, I will get an email alert. I know you can achieve this with built in auditing but you have to manually check the logs, I want something that will alert me via email to unusual file changes. Anyone know of something like this?

 

[Schro]

Netwrix.

*Disclaimer - I'm a managed service provider for them and can resell/lease it.

 

[Sp33dFr33k]

You could also try something like FSRM to monitor the shares. You can configure it to monitor for file types or extensions used by ransomware and have it notify you. We used to use FSRM to block the file types generated by the ransomware. Since it couldn't create the file it wouldn't encrypt them. I'm sure they're smarter now but it worked for us back then.

There are several good guides out there with different approaches.

Here's one:
Cryptolocker Canary - detect it early!

or

Stop Cryptolocker from Hitting Windows File Shares with FSRM

You could also just push out Crypto Prevent: CryptoPrevent Malware Prevention

 

[Shadohh]

McAfee Application Control | Intel Security Products

 

[diizzy]

Any type of file server antivirus software will prevent this, that in conjunction with backups shouldn't be an issue at all.
http://media.kaspersky.com/pdf/b2b/KSFS_Datasheet.pdf <-- It's even mentioned in the product sheet ;-)

 

[ashman]

Many products claim a lot of things, I have not heard or read of one instance where a ransomware infection was stopped by AV. I also have an aversion to Kaspersky products as I find them incredibly intrusive and aggressive, perhaps they have changed and gotten better.

Thanks though.