Hunt Engine
Not inference. Not signatures. Evidence. The detection layer of DDR.
* Observed across large enterprise environments and billions of file inspections daily. How we measure
Detection Capabilities
Each model targets a distinct threat class across the data attack surface.
Unknown ransomware detected by inspecting inside the file. Trained on 2,300+ families. Catches what signatures miss.
Selective data manipulation by actors with legitimate access.
Trojans, backdoors, rootkits, and cryptominers that survived backup cycles. Found before they reinfect on restore.
Your rules run alongside Elastio-managed detections. Write once in SQL, YARA, or Regex. Deployed across live data, replicated data, and backups immediately. No software update required.
How SOC teams use Custom Hunts →Model-Driven Detection
Independent models. Run concurrently. Each targets a distinct dimension of how ransomware alters data. Combined, they cover what no single approach can.
Ransomware Intelligence
Reverse-engineered from 2,300+ families and 10,000+ variants. Identifies which family, which variant, and exactly which files are affected — not just that something is wrong. 25–40 new samples analyzed weekly.
Behavioral Analysis
Pre-trained on the full ransomware landscape. Does not require your data. Catches unknown and zero-day ransomware with no prior signature. Fewer than 5 false positives per 10 million files.
Temporal Analysis
Tracks file evolution incrementally across every data source. Catches slow encryption stretched over days or weeks — attacks that point-in-time inspection cannot see.
Encryption Detection
Analyzes the raw data stream using the first 64KB of each file. Distinguishes true randomness from cryptographic randomness. Independent of all other models. Strong for insider threats — even one newly encrypted file per day stands out.
How Hunt Runs
Two tools. Different purposes. Used together. The Hunt CLI investigates mounted snapshots and backups forensically. The Elastio platform runs the detection models above continuously across your entire data estate.