Deception Engineering: exploring the use of Windows Service Canaries against ransomware

This report describes a prototype defensive technique—'Killed Process Canary'—designed to detect Ryuk-style ransomware activity that terminates Windows services prior to encryption; multiple disguised Windows services share a counter, trigger a DNS canary token when stopped, and hibernate the host to limit impact. The write-up covers Ryuk TTPs motivating the approach, implementation details, how DNS tokens encode host identity for alerting, and caveats about unknown real-world effectiveness and possible attacker countermeasures.