Ransomware detection and mitigation

One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to:

• scan a plurality of files of computing apparatus, and for respective files, identify a first filename extension, and a first four-byte sequence that corresponds to the first filename extension, and store the first filename extensions and identifying information for the first four-byte sequences in a data structure;
• determine that a process has, within a temporal window, changed a number of existing files exceeding a threshold, wherein determining that process has changed an existing file comprises detecting that the process has changed a file extension for the existing file to a second filename extension different from the first filename extension, and a second four byte sequence for the changed file is different from the first four-byte sequence;
• and
• based on the determining, taking a ransomware remediation action.

A computer-implemented method, comprising:

• creating a system profile for a computing system, the system profile comprising a table of file name extensions correlated with magic bytes for the file name extensions, wherein the magic bytes comprise a sequence of a first four bytes for a file name extension, and further comprising heuristic data according to usage patterns for the computing system;
• determining that a process has, within a threshold time span according to the heuristic data, created a number of files having a suspicious file extension, the number of files exceeding a number threshold according to the heuristic data, wherein the suspicious file extension is a file extension that did not appear in the system profile before the number of files were created;
• querying a remote security server with information about the process and the suspicious file extension;
• receiving from the remote security server a notification that the process is suspected ransomware;
• and
• mitigating the suspected ransomware.