About
RansomWhere? is a macOS utility that generically targets ransomware by looking for a behavior common to nearly all of it: the creation of encrypted files. It continuously analyzes file entropy to identify encryption activity in real time. When it detects an untrusted process rapidly encrypting files, it suspends that process and alerts the user, who can then terminate it if it is malicious or allow it to continue if it is a false positive.
The alert shows the process name, PID, path, and arguments, along with options to view code signing information, VirusTotal detections, and process ancestry, plus a list of the files being encrypted. Choosing "Allow" or "Block" can be saved as a rule with "Remember my decision" so the same process is not prompted again. Rules can be viewed and managed in the Rules window, and a Notarization Mode setting can be enabled to trust notarized and Mac App Store applications.
Because RansomWhere? uses Apple's Endpoint Security framework, it requires elevated system privileges and Full Disk Access, which the installer guides you through granting. It runs on macOS 10.15 and later. The developers note that legitimate software, such as encrypted messaging apps or browsers, may also trigger alerts, so users should verify a process before allowing it.
What's new
All release notesHomebrew cask ransomwhere 2.2.0 (sha256 982b0b9c3027947e0aaca16d7936fe3e6639ddabe8fafe979c50c7d8c4302af1).