[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71AX8YKYVRZ724TRFPNZE4M":3,"skill-same:01M71AX8YKYVRZ724TRFPNZE4M":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":59,"updatedAt":60,"install":61,"resources":73},"01M71AX8YKYVRZ724TRFPNZE4M","cyber-deploying-ransomware-canary-files",null,"Deploys and monitors ransomware canary files across critical directories using Python''s watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-deploying-ransomware-canary-files\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"ransomware","deploying ransomware canary files","canary","cyber deploying ransomware canary files","files","modify","library","watchdog","rename","read","delete","credentials","across","database","critical","false","cybersecurity","time","canary-files","directories","2026-11-10 10:12:30",false,"---\nname: cyber-deploying-ransomware-canary-files\ndescription: \"Deploys and monitors ransomware canary files across critical directories using Python''s watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and \"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: deploying-ransomware-canary-files | description: 'Deploys and monitors ransomware canary files across critical directories |   using Python''s watchdog library for real-time filesystem event detection. Places |   strategically named decoy files that mimic high-value targets (financial records, |   credentials, database exports) in locations ransomware typically enumerates first. |   Monitors for any read, modify, rename, or delete operations on canary files and |   triggers immediate alert\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Deploying Ransomware Canary Files\n\n## When to Use\n\n- Deploying proactive ransomware detection on file servers, NAS devices, or endpoint systems\n- Building an early-warning system that detects ransomware before it encrypts business-critical data\n- Supplementing EDR solutions with lightweight canary file monitoring on systems where agents cannot be deployed\n- Testing ransomware incident response procedures by simulating canary file triggers\n- Monitoring shared drives, home directories, and backup volumes for unauthorized file operations\n\n**Do not use** as a replacement for endpoint protection, backup strategy, or network segmentation. Canary files are a detection layer, not a prevention mechanism.\n\n## Prerequisites\n\n- Python 3.8+ with pip\n- watchdog library (pip install watchdog)\n- Write access to directories where canary files will be placed\n- SMTP server credentials or Slack webhook URL for alerting\n- Administrative access for placing canaries in system directories\n\n## Workflow\n\n### Step 1: Generate Canary Files\n\nCreate decoy files with realistic names and content that attract ransomware scanners. Files should have names like `Passwords.xlsx`, `Financial_Report_2026.docx`, `backup_credentials.csv` and contain plausible-looking but fake data. Place them in directories ransomware typically targets first: user desktops, Documents folders, network share roots, and backup paths.\n\n### Step 2: Deploy Filesystem Monitor\n\nUse Python's watchdog library with a custom `FileSystemEventHandler` that watches canary file paths. The handler triggers on `on_modified`, `on_deleted`, `on_moved`, and `on_created` events for canary files. Any legitimate user or process should never touch these files, so any interaction is a high-confidence indicator of ransomware or unauthorized access.\n\n### Step 3: Configure Alert Pipeline\n\nWire the filesystem monitor to multiple alert channels: email via SMTP, Slack webhook POST, syslog forwarding to SIEM, and local log file. Include the triggering event type, file path, timestamp, and process information (when available) in alert payloads.\n\n### Step 4: Validate and Test\n\nSimulate ransomware behavior by programmatically modifying, renaming, and deleting canary files to verify the detection pipeline fires correctly. Measure time-to-alert and validate alert delivery across all configured channels.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Canary File** | A decoy file placed in a monitored directory that triggers an alert when accessed, modified, or deleted |\n| **Watchdog** | Python library that monitors filesystem events using OS-native APIs (inotify on Linux, FSEvents on macOS, ReadDirectoryChangesW on Windows) |\n| **Honey File** | Synonym for canary file; a fake document designed to attract and detect malicious activity |\n| **Entropy Check** | Measuring randomness in file content to detect encryption (ransomware produces high-entropy output) |\n\n## Tools & Systems\n\n- **watchdog**: Python filesystem monitoring library using OS-native event APIs\n- **smtplib**: Python standard library for SMTP email alerting\n- **requests**: HTTP library for Slack webhook integration\n- **hashlib**: SHA-256 hashing for canary file integrity verification\n- **psutil**: Process information gathering when canary file access is detected\n\n## Output Format\n\n```\nRANSOMWARE CANARY ALERT\n========================\nTimestamp: 2026-03-11T14:23:07Z\nEvent: FILE_MODIFIED\nCanary File: \u002Fsrv\u002Fshares\u002Ffinance\u002FPasswords.xlsx\nDirectory: \u002Fsrv\u002Fshares\u002Ffinance\nSHA-256 Before: a3f2...8b4c\nSHA-256 After: 7e91...2d3f\nAlert Channels: [email, slack, syslog]\nAction: Investigate immediately - potential ransomware activity\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Deploying Ransomware Canary Files\n\n## When to Use\n\n- Deploying proactive ransomware detection on file servers, NAS devices, or endpoint systems\n- Building an early-warning system that detects ransomware before it encrypts business-critical data\n- Supplementing EDR solutions with lightweight canary file monitoring on systems where agents cannot be deployed\n- Testing ransomware incident response procedures by simulating canary file triggers\n- Monitoring shared drives, home directories, and backup volumes for unauthorized file operations\n\n**Do not use** as a replacement for endpoint protection, backup strategy, or network segmentation. Canary files are a detection layer, not a prevention mechanism.\n\n## Prerequisites\n\n- Python 3.8+ with pip\n- watchdog library (pip install watchdog)\n- Write access to directories where canary files will be placed\n- SMTP server credentials or Slack webhook URL for alerting\n- Administrative access for placing canaries in system directories\n\n## Workflow\n\n### Step 1: Generate Canary Files\n\nCreate decoy files with realistic names and content that attract ransomware scanners. Files should have names like `Passwords.xlsx`, `Financial_Report_2026.docx`, `backup_credentials.csv` and contain plausible-looking but fake data. Place them in directories ransomware typically targets first: user desktops, Documents folders, network share roots, and backup paths.\n\n### Step 2: Deploy Filesystem Monitor\n\nUse Python's watchdog library with a custom `FileSystemEventHandler` that watches canary file paths. The handler triggers on `on_modified`, `on_deleted`, `on_moved`, and `on_created` events for canary files. Any legitimate user or process should never touch these files, so any interaction is a high-confidence indicator of ransomware or unauthorized access.\n\n### Step 3: Configure Alert Pipeline\n\nWire the filesystem monitor to multiple alert channels: email via SMTP, Slack webhook POST, syslog forwarding to SIEM, and local log file. Include the triggering event type, file path, timestamp, and process information (when available) in alert payloads.\n\n### Step 4: Validate and Test\n\nSimulate ransomware behavior by programmatically modifying, renaming, and deleting canary files to verify the detection pipeline fires correctly. Measure time-to-alert and validate alert delivery across all configured channels.\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Canary File** | A decoy file placed in a monitored directory that triggers an alert when accessed, modified, or deleted |\n| **Watchdog** | Python library that monitors filesystem events using OS-native APIs (inotify on Linux, FSEvents on macOS, ReadDirectoryChangesW on Windows) |\n| **Honey File** | Synonym for canary file; a fake document designed to attract and detect malicious activity |\n| **Entropy Check** | Measuring randomness in file content to detect encryption (ransomware produces high-entropy output) |\n\n## Tools & Systems\n\n- **watchdog**: Python filesystem monitoring library using OS-native event APIs\n- **smtplib**: Python standard library for SMTP email alerting\n- **requests**: HTTP library for Slack webhook integration\n- **hashlib**: SHA-256 hashing for canary file integrity verification\n- **psutil**: Process information gathering when canary file access is detected\n\n## Output Format\n\n```\nRANSOMWARE CANARY ALERT\n========================\nTimestamp: 2026-03-11T14:23:07Z\nEvent: FILE_MODIFIED\nCanary File: \u002Fsrv\u002Fshares\u002Ffinance\u002FPasswords.xlsx\nDirectory: \u002Fsrv\u002Fshares\u002Ffinance\nSHA-256 Before: a3f2...8b4c\nSHA-256 After: 7e91...2d3f\nAlert Channels: [email, slack, syslog]\nAction: Investigate immediately - potential ransomware activity\n```\n",{"hide":49,"name":5,"source":50,"license":15,"description":51,"authorized_lab":45,"origin_frontmatter":52},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","Deploys and monitors ransomware canary files across critical directories using Python''s watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and ","name: deploying-ransomware-canary-files | description: 'Deploys and monitors ransomware canary files across critical directories |   using Python''s watchdog library for real-time filesystem event detection. Places |   strategically named decoy files that mimic high-value targets (financial records, |   credentials, database exports) in locations ransomware typically enumerates first. |   Monitors for any read, modify, rename, or delete operations on canary files and |   triggers immediate alert","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-deploying-ransomware-canary-files",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":49},[63,66,69],{"tool":64,"command":65},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-deploying-ransomware-canary-files",{"tool":67,"command":68},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-deploying-ransomware-canary-files",{"tool":70,"command":71},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-deploying-ransomware-canary-files","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-deploying-ransomware-canary-files\u002FSKILL.md",[],[75,99,123,151,180,199],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":44},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":44},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[106,107,86,108,109,110,111,112,113,114,115,92,116,94,117,118,119,120,121,122],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":132,"publishedAt":44},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[129],{"categoryNo":130,"categoryName":131,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[133,134,135,136,137,138,139,140,141,94,142,143,144,145,146,147,148,110,149,150],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":165,"publishedAt":44},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[157,160],{"categoryNo":158,"categoryName":159,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":161,"categoryName":162,"taxonomyType":163,"taxonomyTypeDesc":164},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[166,96,167,133,86,168,169,170,110,171,172,173,174,175,176,177,178,179,92,94],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":186,"publishedAt":44},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[187,188,189,190,191,192,193,194,195,94,196,117,197,198],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":79,"licenseFileUrl":6,"sourceHtmlUrl":203,"categories":204,"keywords":217,"publishedAt":44},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[205,208,211,214],{"categoryNo":206,"categoryName":207,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":209,"categoryName":210,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":212,"categoryName":213,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":215,"categoryName":216,"taxonomyType":163,"taxonomyTypeDesc":164},"01JBSEEDCAT000000000000036","内容创作者",[218,219,220,94,117,221,86,222,111,92,223],"writing","writing skills","new","work","editing","Existing"]