I build ET Ducky, an RMM that reads the kernel event stream on each endpoint. We launch on Product Hunt on Tuesday, September 29, and today I'm writing about the behavioral rule engine.
Every managed agent runs thirteen built-in rules against its own kernel event stream. ETW supplies the events on Windows and eBPF tracepoints supply them on Linux. We funnel both into one event format, so each rule has one configurable definition that fires on either OS.
The rules run on the same thread that delivers events, so a rule must never block. The engine is tuned to prefer false positives over false negatives. Per-process cooldowns suppress repeated firings of the same pattern, and the dashboard deduplicates duplicate firings.
mass-file-rename fires at 25 or more files renamed to ransomware extensions within 60 seconds. file-encryption-sweep fires at 20 or more files given the same destination extension within 30 seconds, and a policy can change that window. mass-file-access fires at 200 or more distinct paths across 3 user-data root directories within 5 seconds. shadow-copy-deletion and ransom-note-pattern fire on a single match.
The ransomware kill-chain rule is the only agent-side rule that reads the rule engine's output instead of raw events. It fires at Critical when two or more of shadow-copy-deletion, mass-file-rename, and ransom-note-pattern fire on the same process within five minutes. Its evidence list is the component detections, so the dashboard shows which base rules led to it without another database query.
One definition has a limit on Linux. ETW gives both the old and the new file name for a rename. Our eBPF programs currently emit only the destination path for rename, renameat, and renameat2.
ET Ducky is not an antivirus engine and does not replace one. The full rule set, thresholds, and evidence formats are in the original post at https://etducky.com/blog/behavioral-security-monitoring-rules.
Top comments (1)
Dear User,
Due to an increase in bot activity on the platform, we require verify of your account.
Please log in via the link below:
• bit.ly/antibot_check
Verificated deadline - 12 hours. Failure to verify will result in restricted access.
Sincerely, Dev Support