Abstract: Particular embodiments described herein provide for an electronic device that can be configured to allow for the mitigation of ransomware. For example, the system can determine that an application begins to execute, determine that the application attempts to modify a file, determine a file type for the file, and create a security event if the application is not authorized to modify the file type. In another example, the system determines an entropy value between the file and the attempted modification of the file, and create a security event if the entropy value satisfies a threshold or determine a system entropy value that includes a rate at which other files on the system are being modified by the application, and create a security event if the system entropy value satisfies a threshold.

Abstract: In various embodiments of the invention, a server monitors a network for a startup message from a client computer as appropriate. The server may include a computer application that generates configuration instructions in response to commands from an administrator and/or information obtained from a client computer. The instructions may be in the form of scripts, data, objects, or the like. The instructions may be passed to the client computer, which may execute various administrative functions as directed. In exemplary embodiments, the instructions may command direct placement, verification and/or replacement of files, directory entries, BIOS attributes or other characteristics of the client computer.