kosta-dev
120 lines
3.5 KiB
Plaintext
120 lines
3.5 KiB
Plaintext
# Linux Ransomware Simulation Scripts
|
||
|
||
## Overview
|
||
|
||
The files in the `zvml-python-sdk/examples/ransomware` folder provide a set of scripts to simulate a ransomware-style
|
||
**encryption and decryption event** on a Linux VM. It is designed for use with **Zerto 10.0 U1+ (ZVML)** to demonstrate
|
||
ransomware detection and alerting capabilities—**without requiring any OVF templates or pre-built Windows VMs**.
|
||
|
||
This is a lightweight, Linux-native alternative to [RanSim](https://github.com/lawndoc/RanSim), ideal for fast
|
||
deployment and testing in Zerto-protected environments.
|
||
|
||
---
|
||
|
||
## Purpose
|
||
|
||
- Simulate encryption of user files to trigger Zerto’s ransomware detection engine.
|
||
- Demonstrate how ZVM (Zerto Virtual Manager) identifies abnormal encryption behavior.
|
||
- Provide a reversible, easy-to-run simulation environment using shell scripts.
|
||
|
||
---
|
||
|
||
## Prerequisites
|
||
|
||
- A Linux VM (Debian, Ubuntu, Rocky, RHEL, etc.)
|
||
- Zerto ZVML (Zerto Virtual Manager Linux) **10.0 U1 or later**
|
||
- A running VRA protecting the VM
|
||
- The VM must be part of an existing **Virtual Protection Group (VPG)**
|
||
- SSH or console access with write and execute permissions
|
||
|
||
---
|
||
|
||
## ZVM Tuning Parameters (Required)
|
||
|
||
Add the following parameters to `tweaks.txt` on your **ZVM appliance**, or apply them using ZVM’s backend interface:
|
||
|
||
```ini
|
||
t_ransomwareAttackThreshold=2
|
||
t_ransomwareEngTrainPeriodSec=60
|
||
t_ransomwareEngCuSumThrsDiff=5
|
||
t_ransomwareEngCuSumThrsSec=60
|
||
t_ransomwareEngAvgTimeSec=180
|
||
t_ransomwareEngCuSumTimeSec=2
|
||
```
|
||
|
||
> **IMPORTANT**: Restart the ZVM appliance (or the VM it's running on) to apply these changes.
|
||
|
||
---
|
||
|
||
## Recommended VM Configuration
|
||
|
||
- At least **90 GB** of total disk space
|
||
- Simulation dataset size: **~2 GB**
|
||
|
||
---
|
||
|
||
## Simulation Instructions
|
||
|
||
### 1. Clone the repository
|
||
|
||
```bash
|
||
git clone https://github.com/your-org/zvml-python-sdk.git
|
||
cd zvml-python-sdk/examples/ransomware
|
||
```
|
||
|
||
### 2. Create the test dataset
|
||
|
||
This command creates a folder containing 2000 files, each 1MB in size:
|
||
|
||
```bash
|
||
mkdir important-files
|
||
./create_data_set.sh 1M 2000 important-files
|
||
```
|
||
|
||
You can modify the size and number of files as needed.
|
||
|
||
### 3. Encrypt the dataset (simulate ransomware)
|
||
|
||
This encrypts all files in the folder using `openssl` and appends an `.encrypted` extension:
|
||
|
||
```bash
|
||
./encrypt_files_recursive.sh ./important-files yourkeyword encrypted
|
||
```
|
||
|
||
- `yourkeyword`: your encryption password
|
||
- `encrypted`: file extension to be appended (e.g., `.encrypted`)
|
||
|
||
> Within **30 to 60 seconds**, ZVM should detect abnormal behavior and trigger an alert.
|
||
|
||
### 4. Decrypt the dataset (restore files)
|
||
|
||
To reverse the simulation and restore the original files:
|
||
|
||
```bash
|
||
./decrypt_files_recursive.sh ./important-files yourkeyword encrypted
|
||
```
|
||
|
||
---
|
||
|
||
## Notes
|
||
|
||
- These scripts use `openssl` for AES-256 encryption.
|
||
- Make sure `openssl` is installed (`apt install openssl` or `yum install openssl` as needed).
|
||
- All operations are local to the Linux VM — no outbound internet or services required.
|
||
- You can modify or extend the scripts for more advanced or varied encryption behavior if needed.
|
||
|
||
---
|
||
|
||
## Disclaimer
|
||
|
||
This simulation is provided **for demonstration and educational purposes only**.
|
||
Do **not** use these scripts on production systems or with sensitive/real data.
|
||
Only use in controlled, isolated lab environments. Always inspect and understand what a script does before execution.
|
||
|
||
---
|
||
|
||
## Credits
|
||
|
||
- Based on concepts from [lawndoc/RanSim](https://github.com/lawndoc/RanSim)
|
||
- Adapted for Linux-based Zerto simulation environments by [Your Name or Team]
|