Raccine
A Windows tool that intercepts and kills ransomware processes attempting to delete shadow copies via vssadmin and other system utilities.
What is Raccine?
Raccine is a simple yet effective ransomware vaccine for Windows systems. It protects against ransomware that attempts to delete Volume Shadow Copy Service (VSS) snapshots by intercepting commands like 'vssadmin.exe delete shadows' and terminating the malicious parent processes. The tool uses YARA rule scanning to detect malicious patterns and kills the entire process tree to prevent encryption.
Windows system administrators, security analysts, and organizations looking for a lightweight, agent-less layer of ransomware defense without deploying full endpoint protection suites.
Raccine offers a unique, low-resource approach to ransomware mitigation by specifically targeting the command-line tools ransomware abuses, with no running service required. Its simulation mode and easy reversibility make it safe to test in production environments.
Overview
A Simple Ransomware Vaccine
Use Cases
Best For
- Blocking ransomware that uses vssadmin.exe to delete shadow copies
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
