Kratos Minifilter is a Windows kernel-mode minifilter driver (Kratos.sys) operating at altitude 425342 via the Filter Manager. It detects ransomware through a multi-level approach: behavioral analysis (monitoring file deletions, renames, and entropy changes), entropy calculation using a kernel-safe lookup table, and structural detection via an inverse whitelist of legitimate file extensions. When ransomware is detected, the driver calculates a 64-bit FNV-1a hash of the executable's initial bytes and blacklists it in the registry to block future executions regardless of filename changes. Legitimate processes are validated by expected name and path to prevent spoofing. The driver requires manual installation with test signing enabled and is designed for use in isolated test environments. Limitations include potential initial false positives on a few files, lack of automatic file recovery, and use of a hash function vulnerable to collision attacks.

Kratos Minifilter aims to prevent ransomware encryption by intercepting malicious file operations and blocking ransomware processes before they execute. It reduces the number of affected files after initial detection runs and claims zero false positives after tuning. However, it does not provide automatic recovery of encrypted files. The driver is intended for defensive research and testing; improper use or deployment on production systems may cause unintended disruptions. There are no known exploits in the wild related to this driver, and it is not a vulnerability but a defensive tool.

This is a defensive security research project, not a vulnerability. No patch or remediation is applicable. Users interested in deploying Kratos Minifilter should do so only in isolated test environments with Secure Boot disabled or test signing enabled. Configuration adjustments can be made to monitored extensions, trusted processes, and scoring thresholds to fit the environment. The author disclaims liability for improper use. No automatic recovery mechanism is provided, so backups remain essential. Review the official GitHub repository for installation and configuration instructions.