Is "assume the attacker has admin, make the files immutable" a useful ransomware defense, or does backup already cover this?
Source Reddit Cybersecurity
Discussion
This content discusses a proposed ransomware defense approach that assumes an attacker has local administrative privileges and enforces immutability on files at the kernel level to prevent modification or deletion. The author built a kernel-level filter driver enforcing Write Once Read Many (WORM) semantics on a mapped drive, tested it against a ransomware sample, and observed that files on the protected drive remained unchanged. The discussion questions whether this approach adds value beyond good backups and considers operational challenges. No exploit or vulnerability is reported; rather, it is a conceptual defense technique shared for community feedback.
r/cybersecurity (opens in a new tab)u/ntsyscall0 points0 comments
I've been building a kernel-level filter driver that enforces WORM semantics
on a mapped drive — existing files can't be modified or deleted regardless of
the caller's privilege level. No detection, no signatures. The premise is that
detection has already failed and the attacker has local admin, which is the
state most real ransomware reaches before it encrypts anything.
Tested against a live AvosLocker sample in an isolated VM with no AV: files
outside the protected drive were encrypted, files inside came through with
matching hashes.
What I actually want to know is whether the idea is worth pursuing:
- Does an immutable-at-the-kernel layer add anything over good backups?
- Would you deploy something like this, or is the operational cost of
"some files can never be changed" too high in practice?
- What breaks this that I'm not seeing?
Video if it helps: https://www.youtube.com/watch?v=RgzEtQrlI9s
Not selling anything — no EV cert yet, so I can't ship even if I wanted to.