Gate 3: Recovery-Destruction
Anti-Ransomware Command Line DENY Policy

Audience: Windows administrators deploying a layered Keeper EPM anti-ransomware baseline.
For an overview of the layered anti-ransomware model and how this gate fits in, see Anti-Ransomware Policies.
This policy is the recovery-destruction gate in a layered Keeper EPM anti-ransomware deployment on Windows. It denies execution of the canonical destructive Windows utilities — vssadmin.exe, wbadmin.exe, bcdedit.exe, wevtutil.exe, fsutil.exe, and cipher.exe — that ransomware families (Conti, LockBit, BlackCat, Royal, Akira lineage) use to delete shadow copies, destroy backups, disable boot recovery, and clear forensic evidence. By targeting the executables themselves, the policy blocks these utilities no matter where they are launched from on disk, by any user, on any in-scope machine.
Step-by-Step: Create the Policy
Create the Application Collection
Before creating the policy, the destructive utilities must be organized into an Application Collection. Filename-only resources match the executable regardless of disk location, which is what gives this policy its "path-independent" behavior.
From the Keeper Admin Console, navigate to Endpoint Privilege Manager → Collections → Applications.
Click New Collection.
In the New Collection modal:
Type:
ApplicationsName:
Ransomware Destructive Utilities (Windows)Click Next.
In the Add Item to Collection modal, check Manually define resource to add each utility as a custom resource.
Add each of the following entries, one at a time, clicking Add after each:
vssadmin.exewbadmin.exebcdedit.exewevtutil.exefsutil.execipher.exe
Save the collection. Note the collection's UID — you will reference it in
ApplicationCheckwhen importing the policy JSON, or select it from the picker when creating the policy in the UI.

Why filename only: A resource entered as vssadmin.exe (without a path) matches that executable wherever it is launched from — C:\Windows\System32, a copy staged under %TEMP%, a renamed-folder dropper, or a USB stick. A resource entered as C:\Windows\System32\vssadmin.exe would only match that one literal path and miss any staged copy.
Create the Policy
Navigate to Endpoint Privilege Manager → Policies and click Create Policy.
Fill in the policy details:
Policy Name:
Deny Ransomware Recovery Destruction (Windows)Policy Type:
File AccessStatus:
Monitorfor the initial pilot. Switch toEnforceonce you have confirmed no legitimate admin or backup tooling is matching these patterns.
Set Filters
User Groups: Select All Users and Groups (wildcard).
Machine Collections: Select your Windows machine collection. If you want this policy to behave as a baseline that any specific Allow policy can override, leave this as Select All. If you want it to take specific-policy precedence, target a named Windows machine collection instead.
Applications: Select the
Ransomware Destructive Utilities (Windows)collection created in Step 1.Leave Date & Time Window unset — destructive ransomware activity should be denied at any hour.

Save and Pilot
Click Save. The policy is pushed to all in-scope endpoints within approximately 30 minutes; users on affected endpoints can trigger an immediate sync via Refresh Policies in the Keeper agent.
Run in Monitor mode for 7–14 days. Review the audit log in Endpoint Privilege Manager → Dashboard for any matches against legitimate administrative or backup workflows.
When monitoring is clean, edit the policy and change Status to
Enforce.
Reference: Policy JSON
The following JSON is the exported form of the finished policy. The <generated-policy-uid> and <uid-of-Ransomware-Destructive-Utilities-collection> placeholders are filled in by the Admin Console when the policy and collection are created.
Last updated


