RansomwareChecker is a portable Windows tool for fast triage after a ransomware attack. It hunts for persistence, post-exploitation tools, tampered security settings and traces of exfiltration, then gives you a clear report and a step-by-step remediation plan.
When a ransomware incident hits, you need to know fast where the attackers persist and what they touched. RansomwareChecker gives you that overview without installing anything or changing the system.
It never deletes, changes or "fixes" anything, so the evidence stays intact for forensics.
No installation and no dependencies beyond the Windows PowerShell 5.1 that ships with Windows. Run it from a USB stick or a share.
Each finding says why it was flagged, why the check exists, which MITRE ATT&CK technique it maps to and what to do next.
Every run writes a plan that follows the incident response process: evidence, containment, eradication, recovery, post-incident.
Use the desktop app with filters, search and expandable details, or the script for automation via GPO or RMM.
Indicators, reasons and remediation steps live in JSON files. Tune them for your environment without recompiling.
This is how results look in the app and in the HTML report. Try it: filter by severity, search, and click a row to expand it.
Sample data for illustration only.
The checks cover techniques typical of human-operated ransomware, from initial access to deployment.
| Area | What it looks for | MITRE ATT&CK |
|---|---|---|
| Autostart | Run/RunOnce keys, Winlogon, IFEO debugger (sticky keys), AppInit_DLLs, Startup folders | T1547, T1546 |
| Scheduled tasks | Non-Microsoft, hidden and newly registered tasks, GUID names, suspicious commands | T1053.005 |
| Services | Binaries outside standard paths, Cobalt Strike psexec_psh pattern, PSEXESVC | T1543.003 |
| WMI & BITS | Event consumers and persistent BITS jobs | T1546.003, T1197 |
| Remote access | AnyDesk, TeamViewer, ScreenConnect, Atera, Splashtop, MEGAsync, WinSCP and more | T1219 |
| Processes | Encoded PowerShell, rundll32 abuse, masquerading, binaries in staging folders | T1059, T1218, T1036 |
| Defenses | Defender disabled or excluded, WDigest, RDP / NLA, firewall, shadow copies, bcdedit | T1562, T1490 |
| Accounts | Local administrators, Guest, recently set passwords | T1078, T1136 |
| Event logs | Log clearing, new services, account changes, brute force, RDP from public IPs, PowerShell | T1070, T1110, T1133 |
| Execution traces | Prefetch, UserAssist, BAM, PSReadLine history | T1059.001, T1003 |
| Exfiltration | rclone configuration, MEGAsync logs and account | T1567 |
| File system | Unsigned tools and attack scripts in staging folders, lsass dumps, ransom notes | T1105, T1486 |
| GPO deployment | Recently modified scheduled tasks, files and registry policies in SYSVOL | T1484.001 |
Run it as administrator for full coverage. Anything that could not be checked is listed in the report under Coverage notes.
Get the latest version from GitHub and unzip it anywhere.
Start RansomwareChecker.exe. It asks for admin rights and runs the first check right away.
Filter by severity, expand findings, then open the HTML report and the remediation plan.
powershell -ExecutionPolicy Bypass -File .\RansomwareChecker.ps1 -DaysBack 30 -OpenReport
Exit code 0 = no Medium/High findings, 1 = Medium, 2 = High. Handy for running at scale via GPO or RMM.
Both the app and the script are signed with a code signing certificate. The public part of the certificate is in the repository, so you can always check that the files have not been modified.
Get-AuthenticodeSignature .\RansomwareChecker.exe, .\RansomwareChecker.ps1
The certificate is self-signed. Import cert\RansomwareChecker.cer once to see the status as Valid; see the README for details.
Short answers to common questions.
No. It is deliberately read-only. It tells you what it found and recommends steps; you decide what to do after validating each finding.
No. It is a fast triage tool. Use it to find a pivot (the first ransom note or detection), then continue with a full timeline from $MFT, event logs, Amcache, ShimCache and SRUM.
No. Everything runs locally. Reports are saved next to the tool in the Reports and Remediation folders.
The tool looks for the same things attackers use, so heuristic engines may flag it. The files are signed and the source is open, so you can verify exactly what it does.
Yes. Run the script via GPO or your RMM with a shared folder as -OutputPath and use the exit code to spot affected hosts.
Nothing. RansomwareChecker is free and open source under the MIT license.
Free, portable and open source. Download it before you need it.