EN: Anti-Ransomware Deep Dive: Honeypots, Pre-Encryption Backup & File Rollback

[jorgeluiznim]

Article 2 of the Harmony Endpoint Deep Dives series · Endpoint Security Management R81.20 (on-premises) · Author: Jorge Luiz

Purpose: dissect the Harmony Endpoint Anti-Ransomware blade: how it detects an attack in progress using honeypot (canary) files, why your files are already backed up before the encryption starts, and how the rollback brings everything back — automatically or manually.

Audience: Security Engineers, Endpoint Administrators, SOC Analysts — beginner friendly.

Prerequisites: basic familiarity with SmartEndpoint policy concepts (see Article 1 of this series: On-Premises Architecture); Endpoint Security client with the Forensics and Anti-Ransomware component installed.

Overview

The Endpoint Security Forensics and Anti-Ransomware component monitors file operations, processes, and network activity for suspicious behavior, analyzes attacks detected by other client components or the Check Point Security Gateway, and applies Remediation to malicious files.

The Anti-Ransomware part of it does something most defenses can't: it assumes some ransomware will start running — and wins anyway. It constantly monitors files and processes for unusual activity. Before a ransomware attack can encrypt files, it backs them up to a safe location. After the attack is stopped, it deletes the files involved in the attack and restores the originals from the backup.

All attack details are organized in the Forensics Analysis Report.

How It Works

The defense sequence: monitor → backup → detect → stop → delete → restore

Honeypot files — the tripwire

Anti-Ransomware plants honeypot (canary) files — decoy files spread across many folders on the client. The moment ransomware modifies one of them, the attack is stopped immediately.

Facts worth knowing about honeypot files (straight from the Administration Guide):

• They are real documents, images, videos and music — you can open and view them.
• Their names include strings such as CP, CheckPoint, Check Point, Check-Point, Sandblast Agent, Sandblast Zero-Day, Endpoint.
• If a honeypot file is deleted, it is automatically recreated after the next system boot.

💡 Tip: educate your helpdesk — users sometimes find these decoy files, think they are junk, and delete them. That's harmless (they come back at next boot), but the tickets are avoidable.

Detection → Forensics: the report chain

Anti-Ransomware is one of several detection sources feeding Forensics. When any component (Anti-Ransomware, Behavioral Guard, Anti-Bot, Threat Emulation, Anti-Malware), the Check Point Security Gateway, or a supported third-party product detects an event, it notifies Forensics through internal communication, and Forensics automatically initiates a complete investigation.

The result is the Forensics Analysis Report, with five sections:

Section	What it shows
Entry Point	How the attack got in
Business Impact	What was affected — restored files appear here
Remediation	What was cleaned — deleted files appear here
Suspicious Activity	Behavior observed during the attack
Incident Details	Full technical detail of the incident

Automatic Threat Analysis — triggers and confidence

Responses are driven by triggers (events from Endpoint components: Anti-Bot, Threat Emulation, Anti-Malware; or Network components: Anti-Bot, Threat Emulation, Anti-Malware, URL Filtering) and by the confidence level:

• High — Endpoint Security is almost certain the file is malicious
• Medium — the file is very likely malicious

Possible automatic responses: Forensics Analysis, File Quarantine (Threat Emulation and Anti-Bot), Machine Quarantine (the Firewall restricts the computer's network access), and Attack Remediation. Administrators can override the confidence level for up to five specific events.

Why Signatures Alone Fall Short: Evasion

Modern malware actively checks whether it's being watched — Is this a VM? A sandbox? A debugger? — and stays dormant or acts benign when it thinks it's under analysis. Check Point's own research catalogs these tricks in the Evasions Encyclopedia and Anti-Debug Encyclopedia (open-sourced as InviZzzible and ShowStopper).

💡 Why this matters here: this is exactly why Anti-Ransomware watches behavior — honeypot files being modified — instead of trusting a static signature. Evasive ransomware that dodges signature scanners still trips the canaries the moment it starts encrypting, and the pre-encryption backup lets you roll back regardless of how the sample hid.

Configuration

All Anti-Ransomware behavior lives in the Forensics and Anti-Ransomware policy. The Default Forensics settings rule applies to the Entire Organization — it can be edited but not deleted. Changes are enforced only after policy install.

Anti-Ransomware Backup settings

Setting	Behavior
Enable Anti-Ransomware	Selected by default
Automatic restore and remediate	Auto-start Remediation after an attack: delete attack-created files and restore originals. If not selected, users must start restoration manually
Restore to selected location	Default is the original location; you can choose a different location
Maximum backup size on disk	Best practice: 1 GB
Backup Time Interval	Within this interval each file is backed up only once, even if changed multiple times
File types to be backed up	View/add/remove types; configurable maximum size of backed-up files

Backup exclusions can be added by Folder (with optional subfolders), Process (name + optional certificate/Signer), or Certificate (signing company name or certificate file).

Quarantine settings (shared Remediation service)

Quarantine is handled by the Remediation service, shared by Forensics/Anti-Ransomware, Anti-Bot, and Threat Extraction/Emulation. When a component requests quarantine, the service terminates the file's process if running, encrypts the file, and stores it compressed with metadata in a protected folder, named by the incident ID.

• Default retention: 90 days
• Default client quarantine path: C:\ProgramData\CheckPoint\EndpointSecurity\Remediation\quarantine
• Exclusions by: file extension, certificate data, MD5 hash, SHA1 hash
• Options to let users delete and/or restore items from quarantine
• Copy quarantine files to a central location — so administrators can work with all incident files from one place
• End-user utility: RemediationManagerUI.exe (in C:\Program Files (x86)\CheckPoint\Endpoint Security\Remediation)

Network-side triggers

For Forensics triggers and Remediation on Network Threat Prevention events, the Security Gateway must have Anti-Bot, Anti-Virus, and Threat Emulation enabled with protection set to Prevent or Ask (with UserCheck).

✅ Best Practice: use the Threat Prevention Recommended Profile (default) — it includes all required settings.

Manual restoration walkthrough (Windows client)

When Automatic restore and remediate is off, the user restores encrypted files like this:

1. Right-click the Endpoint Security taskbar icon > Display Overview
2. Click Forensics and Anti-Ransomware
3. In the Analyzed cases table, click Restore Files on the relevant incident row
4. Click Restore (if a note says files were already restored — click Cancel, no need to restore again)
5. Step 1 of 2: choose Restore files to the original location (default) or Restore to selected location. Note: "Delete files created by the attack, including encrypted files" is selected by default
6. Step 2 of 2: click Restore — the window shows restored files and locations
7. Click Close

Best Practices

✅ Best Practice: allow 1 GB for the Anti-Ransomware maximum backup size on disk.

✅ Best Practice: configure Copy quarantine files to a central location, so the Quarantine Manager for Administrators can import all files related to an incident from one accessible location.

✅ Best Practice: if you do not enable Automatic restore and remediate, prepare guidance for end users on the manual restoration steps — and tell them what to select when there is more than one option.

Common Mistakes

Mistake	Impact	Solution
Leaving Automatic restore and remediate off without instructing users	Encrypted files stay encrypted until someone runs manual restoration	Enable it, or document the 7-step manual flow for your helpdesk
Not setting Network blades to Prevent/Ask	Network-detected events never trigger Forensics/Remediation	Use the Threat Prevention Recommended Profile
Editing the database with GuiDBEdit/dbedit casually	Can corrupt the management database	Only under Check Point Support/R&D instruction
Treating honeypot files as junk and deleting them	None technically (recreated at boot) — but generates confusion/tickets	Educate users and helpdesk

Troubleshooting

Symptom: after a ransomware incident, user files remain encrypted
Environment: Endpoint Security client on Windows, Forensics and Anti-Ransomware component installed
Root Cause (most common): Automatic restore and remediate is not selected in the policy — restoration is waiting for a manual start

Resolution:

1. On the client: taskbar icon > Display Overview > Forensics and Anti-Ransomware
2. Find the incident in the Analyzed cases table > Restore Files
3. Follow the 2-step restore wizard (the delete-attack-files option is pre-selected)
4. For the future: enable Automatic restore and remediate in the policy and install policy

FAQ

Q: Does Anti-Ransomware rely on signatures to detect ransomware?
A: The mechanism described here is behavioral: it monitors files and processes for unusual activity and uses honeypot files as tripwires. That is why it can stop attacks that were never seen before.

Q: When exactly is the backup taken?
A: Before the attack can encrypt files — backup runs as suspicious activity is detected, subject to the Backup Time Interval (each file is backed up only once within the interval, even if it changes multiple times).

Q: Where do restored files go?
A: To their original location by default; the policy (or the user, during manual restore) can choose a different location.

Q: A user deleted one of the decoy files. Is protection broken?
A: No — honeypot files are automatically recreated after the next system boot.

Q: How long do quarantined files stay recoverable?
A: 90 days by default. Administrators can also allow users to delete and/or restore quarantined items, and copy quarantine to a central location.

References

• Check Point R81.20 Endpoint Security Administration Guide (PDF) — chapter "Endpoint Security Anti-Ransomware, Behavioral Guard and Forensics"
• sk105122 — Forensics analyze incidents detected by external systems (content verified 2026-07-16)
• sk116024 — Troubleshooting Forensics Integration with Third Party Anti-Virus Vendors (content verified 2026-07-16)

---

Supported Versions: Endpoint Security Management R81.20 (on-premises), Windows clients  |  Last Updated: 2026-07-16  |  Author: Jorge Luiz  |  Article 2 of the Harmony Endpoint Deep Dives series