---
locale: "en"
updated_at: "2026-07-16T16:47:51.704Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/guides/configuration/detect-ransomware"
---

# Detect Ransomware with FileAudit

Detect and stop file-encryption attacks using mass access alerts and an automated logoff script

## Goal

Configure FileAudit to detect a ransomware encryption attack and react to it automatically. 

You will create three mass access alerts and attach a script that logs off the offending user as soon as the attack is detected, before an administrator even reads the notification.

This guide assumes your [audit paths](/fileaudit/docs/guides/operations/manage-windows-audit) and [email settings](/fileaudit/docs/guides/configuration/configure-email-settings) are already configured.

## How ransomware encryption shows up in FileAudit

When ransomware encrypts a file, it performs three operations in sequence: 

1. It reads the file content into memory,
2. writes the encrypted data into a new file,
3. then deletes the original.

Across many files at once, this produces **a burst of file access events** on the server.

In FileAudit, this burst appears as three consecutive [access types](/fileaudit/docs/reference/access-types): a read, a write, and a delete. 

To catch it, you set **one mass alert for each**, all on the same threshold. When all three fire at the same time, you are almost certainly looking at a mass encryption attack.

> **Note**
>
> To learn more about how FileAudit detects ransomware, read our blog article on [How to Detect Ransomware with FileAudit](/blog/data-security/how-to-detect-ransomware-with-fileaudit).

## Create the three mass access alerts

Create one mass alert each for read, write, and delete access. Use the same threshold on all three so they trigger together during an attack.

1. Go to the **Access** tab under **Alerts** and select **Add a mass alert**.
2. Give the alert a name (for example, *Mass Delete*) and select the matching access type.
3. Leave the threshold at its default of **100 events in 1 minute**. This is the recommended setting. 
The three alerts must use the **same threshold**. If they differ, they will not fire together and you lose the read-write-delete signal that identifies an attack.
  ![Mass access alert configuration](https://a.storyblok.com/f/122374/1040x687/85b098db1d/mass-access-alert-configuration.png)
4. In the **Paths** tab, enter `*` to cover every audited path.
  ![Audit a Windows monitored path](https://a.storyblok.com/f/122374/1298x696/26d144046d/audit-windows-monitored-path.png)
5. In the **Email** tab, enter the recipients who should receive the alert.
6. Save the alert.
7. Repeat steps 2 to 6 for the *Mass Write* and *Mass Read* alerts.

The three alerts now appear in the **Alerts** tab.

![List mass access alerts](https://a.storyblok.com/f/122374/810x660/43f2d598ca/list-mass-access-alerts.png)

## Add a reaction script to stop the attack

FileAudit can run a script automatically when an alert fires, closing the attacker's session before an administrator reads the notification. FileAudit ships with predefined ransomware scripts, so you do not need to write or download anything. Choose one script and apply the same one to all three alerts.

1. Open one of the three alerts and go to the **Execution** tab.
2. In the **Executed action** dropdown, select **Add new action**.
3. In the **Predefined scripts** panel on the right, click **View scripts**.
4. Under **Ransomware scripts**, choose one of the three options (see below), then save the action.
5. Open the other two alerts and select the same action from the **Executed action** dropdown so all three use it.

![View predefined scripts](https://a.storyblok.com/f/122374/922x556/0c75a27beb/add-new-action-view-predefined-scripts.png)

The three **Ransomware scripts** options differ only in how aggressively they lock out the threat:

| Script | What it does | When to use it |
| --- | --- | --- |
| **Log off user** | Logs off the session that triggered the alerts. | Stops the active encryption process with the lightest impact. |
| **Log off & disable user** | Logs off the session and disables the user account. | Prevents the same account from signing back in to resume the attack. |
| **Log off user & disable user and computer accounts** | Logs off the session, disables the user account, and disables the computer account. | Strongest containment: also blocks the source machine from the domain. |

![Predefined scripts](https://a.storyblok.com/f/122374/892x614/8b0ac25d89/predefinded-scripts.png)

> **⚠️ Important**
>
> The action must run under a domain administrator account. Logging off a session, and disabling user or computer accounts, requires domain administrator rights. Enter those credentials in the action's Domain, Username, and Password fields.