Detect and isolate ransomware with Claude (Anthropic), EDR, SIEM and Slack

This workflow provides real-time detection of ransomware encryption patterns using Claude AI, with automated system isolation and incident response.

How it works

1. File System Monitoring - Continuously monitors file operations (create, modify, rename, delete) across critical directories
2. Behavior Pattern Collection - Aggregates file operation metrics in 30-second windows (entropy changes, extension changes, I/O velocity)
3. AI Threat Analysis - Claude AI analyzes patterns against known ransomware behaviors (mass encryption, shadow copy deletion, etc.)
4. Threat Scoring & Classification - Assigns threat scores (0-100) and classifies attack types (crypto-locker, wiper, etc.)
5. Auto-Isolation Decision - Determines if immediate network isolation is required based on confidence thresholds
6. System Quarantine - Executes automated isolation: disable network adapters, block shares, kill suspicious processes
7. Forensic Snapshot - Captures system state, process tree, network connections, and file operation logs
8. Incident Response Alert - Notifies SOC team with detailed threat intelligence and recommended actions
9. Evidence Preservation - Stores forensic data and AI analysis in SIEM for investigation

Detection Capabilities

• Entropy Analysis: Detects high-entropy file creation (encrypted data signature)
• Extension Scanning: Identifies suspicious extension changes (.docx → .locked, .encrypted, .crypted)
• I/O Velocity: Flags abnormal file modification rates (>100 files/min)
• Shadow Copy Deletion: Detects vssadmin.exe / wmic.exe shadow copy deletion attempts
• Ransom Note Detection: Identifies README.txt, HOW_TO_DECRYPT.html creation patterns
• Lateral Movement: Monitors SMB/RDP connection spikes from infected hosts
• Process Behavior: Analyzes suspicious parent-child process relationships

Setup Steps

1. Import workflow into n8n
2. Configure credentials:
   • Anthropic API - Claude AI for threat analysis
   • Windows Event Collector / Sysmon - File system event source
   • EDR API (CrowdStrike/Defender/SentinelOne) - For isolation commands
   • SIEM API (Splunk/Elastic) - For log forwarding
   • Slack/PagerDuty - For SOC alerts
3. Install file system watcher on monitored endpoints (sysmon, osquery, or auditd)
4. Configure isolation thresholds (default: threat_score >= 75)
5. Test isolation procedure in sandbox environment
6. Activate workflow

Sample Detection Event

{
 "hostname": "DESKTOP-WKS-042",
 "username": "jdoe",
 "timestamp": "2025-02-25T14:23:17Z",
 "detection_window_seconds": 30,
 "file_operations": {
 "files_modified": 247,
 "files_renamed": 189,
 "files_created": 58,
 "files_deleted": 31,
 "avg_entropy_increase": 7.89,
 "suspicious_extensions": [".locked", ".crypted", ".encrypted"],
 "ransom_notes_created": ["README_DECRYPT.txt", "HOW_TO_RECOVER.html"]
 },
 "process_activity": {
 "high_io_processes": [
 {"name": "explorer.exe", "pid": 4782, "io_rate": "523 ops/sec"},
 {"name": "svchost.exe", "pid": 2194, "io_rate": "412 ops/sec"}
 ],
 "suspicious_commands": [
 "vssadmin.exe delete shadows /all /quiet",
 "wmic shadowcopy delete",
 "bcdedit /set {default} recoveryenabled no"
 ]
 },
 "network_activity": {
 "c2_connections": [
 {"ip": "185.220.101.32", "port": 443, "country": "RU"},
 {"ip": "194.165.16.85", "port": 8443, "country": "NL"}
 ],
 "lateral_movement": [
 {"target": "FILE-SERVER-01", "protocol": "SMB", "status": "success"},
 {"target": "DB-SERVER-03", "protocol": "RDP", "status": "failed"}
 ]
 }
}

Threat Intelligence Sources

• MITRE ATT&CK Framework (T1486 - Data Encrypted for Impact, T1490 - Inhibit System Recovery)
• Known ransomware families: LockBit, BlackCat/ALPHV, Royal, Play, Cl0p
• File extension IOCs from ransomware tracking feeds
• Behavioral signatures from recent campaigns

Compliance & Forensics

• Chain of Custody: All isolation actions logged with timestamps and justifications
• NIST CSF Alignment: DE.CM-7 (Monitoring for unauthorized activity), RS.MI-3 (Incident containment)
• Evidence Integrity: Forensic snapshots include cryptographic hashes for court admissibility
• Post-Incident Review: AI analysis archived for threat hunting and pattern improvement