Build-Your-Own-Ransomware workshop teaches attack and detection

Build-Your-Own-Ransomware is a hands-on workshop that walks you through hybrid encryption with master and ephemeral keys, file system enumeration and evasion. It pairs the exercises with detection material such as RansomFS, which spots ransomware via the Windows Projected File System. Microsoft built ProjFS so a user-mode provider can project data from a backing store as files and directories, with VFS for Git as the showcase. RansomFS repurposes that to plant canary directories in spots like C:\, betting that ransomware walks the drive depth-first via FindFirstFile, and feeds what it sees into rename, entropy and magic-header detectors that can kill the offending process.