Raccine
A Windows tool that intercepts and kills ransomware processes attempting to delete shadow copies via vssadmin and other system utilities.
What is Raccine?
Raccine is a simple yet effective ransomware vaccine for Windows systems. It protects against ransomware that attempts to delete Volume Shadow Copy Service (VSS) snapshots by intercepting commands like 'vssadmin.exe delete shadows' and terminating the malicious parent processes. The tool uses YARA rule scanning to detect malicious patterns and kills the entire process tree to prevent encryption.
Windows system administrators, security analysts, and organizations looking for a lightweight, agent-less layer of ransomware defense without deploying full endpoint protection suites.
Raccine offers a unique, low-resource approach to ransomware mitigation by specifically targeting the command-line tools ransomware abuses, with no running service required. Its simulation mode and easy reversibility make it safe to test in production environments.
Overview
A Simple Ransomware Vaccine
Use Cases
Best For
- Blocking ransomware that uses vssadmin.exe to delete shadow copies
- Adding a lightweight, agent-less layer to existing Windows security stacks
- Testing ransomware defense impact with simulation mode before full deployment
- Forensic logging of ransomware command-line activity via Event Log integration
- Extending protection to custom process names via registry patch modification
- Organizations needing a simple, reversible security measure without complex installation
Not Ideal For
- Environments where vssadmin.exe or wmic.exe is used for legitimate backup or system maintenance tasks
- Organizations needing comprehensive endpoint protection that covers all ransomware vectors, including scheduled tasks or fileless attacks
- Systems with critical services that cannot tolerate abrupt process termination, as Raccine kills entire parent trees indiscriminately
- Teams requiring actively maintained security tools with regular updates and vendor support
Pros & Cons
Pros
Requires no running service or continuous process, reducing system overhead and complexity, as stated in the README's advantages.
Can be uninstalled quickly via registry patches and batch files, allowing safe deployment and removal without permanent changes.
Uses YARA rules to scan command-line parameters and parent process memory, enabling customizable detection and updates against evolving threats.
Logs all interceptions without killing processes, letting administrators assess impact on legitimate software before full deployment.
Cons
The project is marked as 'Inactively Maintained', meaning YARA rules may become outdated and bug fixes are unlikely, reducing long-term reliability.
Kills entire parent process trees, which can disrupt backup solutions and other applications using intercepted commands, as warned in the README's disadvantages.
Only intercepts specific utilities like vssadmin.exe and misses techniques such as ransomware invoked via scheduled tasks (schtasks), leaving blind spots.
Frequently Asked Questions
Related Projects
sysmon-configSysmon configuration file template with default high-quality event tracing
Hunting ELK (HELK)The Hunting ELK
sysmon-modularA repository of sysmon configuration modules
stenographerStenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.