Malicious activity detection, validation, and remediation in virtualized file servers

A system comprising:

• a distributed file server hosting files across a plurality of computing nodes including a first computing node and a second computing node;
• an analytics service, the analytics service configured to:
• detect one or more file server events in the distributed file server indicative of malicious activity;
• identify candidate files in the distributed file server, the candidate files suspected of being compromised by the malicious activity;
• and
• validate the candidate files were compromised by the malicious activity, wherein said validate comprises comparing, for a sample file of the candidate files, a file type of the sample file prior to detection of the malicious activity and a file type of the sample file after the malicious activity;
• and
• recover a share of the distributed file server including the candidate files at least in part by replacing the candidate files with stored versions file from a snapshot of the share taken prior to the malicious activity, a first portion of the snapshot of the share at the first computing node and a second portion of the snapshot of the share at the second computing node.

A method comprising:

• detecting one or more file server events in a distributed file server indicative of malicious activity, the distributed file server hosting files distributed across multiple computing nodes including a first computing node and a second computing node;
• identifying candidate files in the distributed file server, the candidate files suspected of being compromised by the malicious activity;
• validating the candidate files were compromised by the malicious activity, wherein said validating comprises comparing, for a sample file of the candidate files, a file type of the sample file prior to detection of the malicious activity and a file type of the sample file after the malicious activity;
• and
• recovering a share of the distributed file server including the candidate files by replacing the candidate files with stored versions from a snapshot of the share taken prior to the detected malicious activity, a first portion of the snapshot of the share at the first computing node and a second portion of the snapshot of the share at the second computing node.