Ctrlk
HomepageSystem Status
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Gate 3: Recovery-Destruction

Anti-Ransomware Command Line DENY Policy

Audience: Windows administrators deploying a layered Keeper EPM anti-ransomware baseline.

For an overview of the layered anti-ransomware model and how this gate fits in, see Anti-Ransomware Policies.

This policy is the recovery-destruction gate in a layered Keeper EPM anti-ransomware deployment on Windows. It denies execution of the canonical destructive Windows utilities — vssadmin.exe, wbadmin.exe, bcdedit.exe, wevtutil.exe, fsutil.exe, and cipher.exe — that ransomware families (Conti, LockBit, BlackCat, Royal, Akira lineage) use to delete shadow copies, destroy backups, disable boot recovery, and clear forensic evidence. By targeting the executables themselves, the policy blocks these utilities no matter where they are launched from on disk, by any user, on any in-scope machine.

Step-by-Step: Create the Policy

1

Create the Application Collection

Before creating the policy, the destructive utilities must be organized into an Application Collection. Filename-only resources match the executable regardless of disk location, which is what gives this policy its "path-independent" behavior.

  1. From the Keeper Admin Console, navigate to Endpoint Privilege Manager → Collections → Applications.

  2. Click New Collection.

  3. In the New Collection modal:

    • Type: Applications

    • Name: Ransomware Destructive Utilities (Windows)

    • Click Next.

  4. In the Add Item to Collection modal, check Manually define resource to add each utility as a custom resource.

  5. Add each of the following entries, one at a time, clicking Add after each:

    1. vssadmin.exe

    2. wbadmin.exe

    3. bcdedit.exe

    4. wevtutil.exe

    5. fsutil.exe

    6. cipher.exe

  6. Save the collection. Note the collection's UID — you will reference it in ApplicationCheck when importing the policy JSON, or select it from the picker when creating the policy in the UI.

Why filename only: A resource entered as vssadmin.exe (without a path) matches that executable wherever it is launched from — C:\Windows\System32, a copy staged under %TEMP%, a renamed-folder dropper, or a USB stick. A resource entered as C:\Windows\System32\vssadmin.exe would only match that one literal path and miss any staged copy.

2

Create the Policy

  1. Navigate to Endpoint Privilege Manager → Policies and click Create Policy.

  2. Fill in the policy details:

    • Policy Name: Deny Ransomware Recovery Destruction (Windows)

    • Policy Type: File Access

    • Status: Monitor for the initial pilot. Switch to Enforce once you have confirmed no legitimate admin or backup tooling is matching these patterns.

3

Add the DENY Control

  1. Click Add Control.

  2. Select Deny.

4

Set Filters

  1. User Groups: Select All Users and Groups (wildcard).

  2. Machine Collections: Select your Windows machine collection. If you want this policy to behave as a baseline that any specific Allow policy can override, leave this as Select All. If you want it to take specific-policy precedence, target a named Windows machine collection instead.

  3. Applications: Select the Ransomware Destructive Utilities (Windows) collection created in Step 1.

  4. Leave Date & Time Window unset — destructive ransomware activity should be denied at any hour.

5

Set the Notification in Advanced Mode

  1. Notification Message: This action has been blocked by Keeper EPM. The requested utility is restricted because it is commonly used to destroy backup and recovery data. Contact your administrator if you have a legitimate business need.

6

Save and Pilot

  1. Click Save. The policy is pushed to all in-scope endpoints within approximately 30 minutes; users on affected endpoints can trigger an immediate sync via Refresh Policies in the Keeper agent.

  2. Run in Monitor mode for 7–14 days. Review the audit log in Endpoint Privilege Manager → Dashboard for any matches against legitimate administrative or backup workflows.

  3. When monitoring is clean, edit the policy and change Status to Enforce.

Reference: Policy JSON

The following JSON is the exported form of the finished policy. The <generated-policy-uid> and <uid-of-Ransomware-Destructive-Utilities-collection> placeholders are filled in by the Admin Console when the policy and collection are created.

PreviousGate 2: EscalationNextGate 4: Data Protection

Last updated