Objective-See RansomWhere? Missing Recent Ransomware Signatures and How Researchers Manually Tuned Detection Rules
Mac users have increasingly been in the crosshairs of ransomware operators, and security researchers have been relying on tools like Objective-See’s RansomWhere? to defend against these threats. Designed to detect suspicious file encryption activities on macOS, RansomWhere? operates by identifying untrusted processes that rapidly create encrypted files. However, despite its reputation and effectiveness in past instances, RansomWhere? has recently shown significant limitations in identifying newer strains of ransomware. This article explores recent ransomware detection challenges, how known ransomware signatures might be missing, and how a dedicated group of researchers have painstakingly fine-tuned detection rules manually.
