Description
The Ransomware Detection checker analyzes the actual data restored from Bacula backups. It does not rely only on backup metadata or catalog information. Instead, it examines restored files and looks for characteristics and changes that may indicate ransomware activity.
The checker combines several independent detection methods, including entropy analysis, file type analysis, file extension consistency, modification time analysis, ransom note detection, and optional comparison with historical verification results. Multiple indicators can be correlated to provide a more meaningful result than relying on a single file characteristic.
The checker is a detection mechanism. It does not prevent ransomware attacks, block malware, or protect source systems from infection. Its purpose is to identify suspicious changes in restored backup data so that administrators can investigate and take action. Early detection can also help prevent affected data from continuing to enter subsequent backups and replacing older healthy restore points during backup retention and rotation.
Installation
This plugin is already pre-installed in Bacularis and it does not require any additional installation.