I want to protect a Windows Fileserver from Locky or other ransomware. Therefore I already created a rule in the server to stop the fileserver whenever someone tries to create a .locky etc.pp. file.
But the guys who create those trojans are not dumb and just use new fileendings, so the idea is to stop the fileserver when there are massively file writes and removals, because a ransomware takes a file, encrypt it, save it as a new file and remove the old file. This behaviour is typical for ransomware and should be able to get spotted.
Therefore I have a Linux machine, which has the Windows Fileserver mounted to /mnt/foo
But now theres the problem: how can I permanently scan this folder for massive file writes/removals?
hope you can help ;)