Understanding Datto EDR's Ransomware Detection

NAVIGATION  Policies

PERMISSIONS   Datto EDR subscription with administrator, analyst, or external analyst-level platform access

Datto EDR is a secure and fully-featured cloud platform that enables MSPs to remotely monitor, manage, and support their endpoints. It also provides an extra layer of security with native ransomware detection. Datto EDR's ransomware detection monitors for the existence of crypto-ransomware on endpoints by using proprietary behavioral analysis of files. Once ransomware is detected, Datto EDR can alert you, isolate the device, and attempt to stop the ransomware processes to keep the infection from spreading. When paired with Ransomware Rollback, ransomware detection offers a powerful early warning and rapid recovery system against malware.

This topic provides an overview of ransomware detection in Datto EDR and answers questions frequently asked by our partners. For details about Ransomware Rollback, refer to Working with Ransomware Rollback. For details about Enhanced Ransomware Rollback, refer to Working with Enhanced Ransomware Detection.

Key benefits

  • Know about ransomware infections instantly. Instead of waiting for a user to report the issue, Datto EDR will notify you when files get encrypted by the ransomware. You'll have more time to respond and possibly prevent the spread.
  • Easily monitor by using policy-driven configuration. The policy-driven approach of Datto EDR enables MSPs to monitor targeted devices easily and at scale for the presence of ransomware. Integrations with key MSP tools, such as Datto RMM, along with email and webhook notification options, ensure that the right resources can be immediately alerted if ransomware is detected.
  • Prevent spreading of ransomware with automatic network isolation and termination of ransomware processes. Once ransomware is detected, you can have Datto EDR isolate the affected device from the network and attempt to stop suspected ransomware processes to prevent further spread of the infection to other devices.
  • Remediate issues remotely. Devices automatically isolated from the network can still contact Datto EDR, enabling you to take effective action to resolve the issue.
  • Recover with Datto Continuity products. When Datto EDR is integrated with Datto RMM + Datto BCDR, you can quickly recover from the ransomware outbreak by restoring the device to a previous state.

Requirements

  • You must have an active Datto EDR subscription.
  • Ransomware detection must be enabled and configured. For more information, refer to Ransomware configuration options.
  • The Datto Endpoint Security agent must be installed on all endpoints you wish to monitor, and those devices must be able to communicate with your EDR instance.

IMPORTANT  If you choose to run Ransomware Detection in Datto EDR, it must be disabled in Datto RMM or RocketCyber, and vice versa.

Compatibility

Ransomware Detection is supported on Windows 10 and above and Windows Server 2012 and above. Operating system support is the same for Standard and Enhanced detection.

For more information, see Hardware and operating system requirements.

You'll find your ransomware detection settings on the Policies page. Clicking the name of a ransomware policy opens its Edit Policy page. From this location, the following configuration options are available.

Click any header to sort the displayed records by the column's value.

Ransomware monitoring options

Details
Field name Definition
Name The name of the policy
Description A brief description of the policy's purpose

 

Detection Options
Field or feature name Definition
Standard Select to monitor any local drive for ransomware activity. Network drives, removable drives, and USB mass storage devices are excluded from being monitored.
Enhanced Select to enable Datto Enhanced Ransomware Detection Monitoring. Enhanced ransomware detection uses low-overhead telemetry from the Datto Rollback service to attribute file activity to specific processes, identify attacks after fewer files are encrypted, and terminate or block the entire malicious process chain. For more information, see Working with Enhanced Ransomware Detection.

IMPORTANT When Enhanced ransomware detection is enabled, Datto Rollback service components are deployed to monitored endpoints, even if File Recovery is set to Disable. In this configuration, the Rollback service runs in a low-overhead monitoring mode. It provides process telemetry to the detection engine but does not retain file history, so file recovery is unavailable. As a result, Rollback service components, including the Rollback Driver Desktop application, are installed on endpoints monitored by a policy with Enhanced ransomware detection enabled.

 

Response Options
Feature name Definition
Kill Process When enabled, Datto EDR attempts to terminate malicious processes as soon as they are detected, helping reduce the impact of a ransomware attack.
When Enhanced ransomware detection is enabled, Datto EDR also attempts to terminate the suspected ransomware process's parent and grandparent processes and prevents the malicious process from restarting.
Isolate Host When selected, if ransomware is suspected on a host, the agent will automatically isolate the endpoint from all network connections except for the EDR portal. If this response is successful, Automatically shutdown infected systems will not execute.
Shutdown When selected, in the event of a ransomware attack, EDR can automatically attempt to shut down infected systems. If Isolate Host or Kill Process are also enabled, EDR will attempt to complete those steps first. If Isolate Host is successful, the shut down response will not execute.

File Recovery options

File Recovery options
Feature name Definition
Disable Select to prevent file recovery (rollback) on endpoints monitored by your ransomware policy. No file history is kept, and rollback is not available.

Note: If Enhanced ransomware detection is enabled, Datto Rollback components are still deployed to monitored endpoints and operate in a low-overhead monitoring mode that supports enhanced detection. To prevent installation of Datto Rollback on a specific endpoint, see Controlling Ransomware Rollback installation in Working with Ransomware Rollback.
Full Disk Tracking Select to deploy the rollback agent and Rollback Driver Desktop application to all endpoints monitored by your ransomware policy and track file changes across the disk. To learn how to leverage the recovery feature in your environment, refer to Working with Ransomware Rollback.

When Full Disk Tracking is selected, the Include Additional Drives option appears. Select the check box to track changes with the Rollback Agent on any local fixed drive. Network drives, removable drives, USB-attached drives, and FAT32-formatted volumes are excluded from monitoring.
Folders & Extensions Select to deploy the rollback agent and Rollback Driver Desktop application to all endpoints monitored by your ransomware policy. In this configuration, the rollback agent only tracks changes for the folders and file extension types you define.

When Folders & Extensions is selected:

  • The Include Additional Drives option appears. Select the check box to track changes with the Rollback Agent on any local fixed drive. Network drives, removable drives, USB-attached drives, and FAT32-formatted volumes are excluded from monitoring.

  • The Preferences section is displayed. See the Preferences table below for a description of these options.

 

Preferences
Feature name Definition
Standard User Folders Select to track changes with the Rollback Agent within the user profile folders on the endpoint (the Users directory, which includes Desktop, Documents, and Downloads).
Documents Select to track changes for the following file extensions (pdf, doc, docx, xls, xlsx, ppt, pptx, odt, ods, odp, txt, rtf, md, tex, csv)
Images Select to track changes for the following file extensions (jpg, jpeg, png, gif, bmp, tif, tiff, svg, heic, heif)
Audio/Video Select to track changes for the following file extensions (mp3, wav, aac, flac, mp4, avi, mkv, mov, wmv)
Archives Select to track changes for the following file extensions (zip, rar, 7z, gz, tar, tar.gz, tgz)
Code Scripts Select to track changes for the following file extensions (py, js, html, htm, css, json, xml, sh, bat, ps1)
Custom Extensions In the Custom Extensions section, you can specify additional file extension types that you would like the rollback agent to track.
1. In the Custom Extensions field, enter the extension type. Do not enter a period before the extension.
2. Click Add. The extension is added.

Cache configuration options

Cache configuration is available only when Full Disk Tracking or Folders & Extensions are selected.

Tracking cache size
Feature name Definition
Maximum Tracking History By default, Datto Rollback retains file change history for a rolling seven-day period, which is the maximum retention period. To reduce the retention period, select a lower value from the drop-down list. The actual retention period may be shorter if disk activity is high and the rollback cache reaches capacity.

Cache Size Type

 To track file changes and undo ransomware infections, the rollback agent creates a cache folder on each protected volume in which it stores historical file information. Once the cache space is exhausted, the agent will begin to purge the oldest file history. The value you specify here will be used for all monitored disks.

  • Relative: The rollback agent will reserve the percentage of the disk's total size that you specify in the Volume Capacity Percentage field for its cache. By default, the agent attempts to allocate 5% of the disk's total size to the cache.

  • Absolute: The rollback agent will reserve the fixed amount of disk space you specify in the Absolute Size field. You must allocate at least 1 GB to the cache.

FAQs

Setting up ransomware detection is as easy as enabling it from the Policies page in your EDR portal. To get started, refer to Working with the Policies page.

Ransomware detection is designed to work alongside other security products you deploy to your customer endpoints.

Device isolation can be reverted by running the Host Isolation Restore extension from the Alerts page. Doing so will revert any isolation that has occurred on a device and return its ability to contact the internet and other devices on the network. Refer to Responding to alerts.

The Datto EDR ransomware detection engine looks for the existence of crypto-ransomware on endpoints by using proprietary behavioral analysis of files.

You can run a simulation package to test Datto EDR's ransomware detection. The simulation package (AutoRS.zip) and a set of instructions (Readme.txt) are available for download from Datto.

NOTE  How to get or run real ransomware is outside the scope of this procedure. The change described here is intended for demonstration purposes only and should never be left in place on an endpoint after the demonstration is complete.

EDR detects ransomware attacks by analyzing file update behavior and detecting file encryption. To test detection of ransomware, follow these steps:

  1. Configure EDR with ransomware detection enabled.
  2. Create a folder under the root (for example, C:\TestRWD).

IMPORTANT  Do not create the folder in the Program Data, AppData, Temp directories or in any other folder not normally targeted by ransomware.

  1. Download the Datto RMM Ransomware Simulation Package (AutoRS2.zip).
  2. Copy the data folder from the simulation package to the folder created in step 2. The data folder contains normal-sized user files of several different types of files; for example, graphic files, text files, and so forth.
  3. Wait at least three minutes before starting the ransomware. The detection engine only correlates encryption activity against files that were last written more than three minutes before the attack begins; newly copied files are otherwise treated as transient.
  4. Download and start the ransomware. It can take up to a minute or more before the encryption process starts, depending on the type of ransomware.
  5. If the ransomware begins to encrypt files, EDR should create an alert and try to isolate the host.

If EDR does not create an alert, check the following:

  • If the files in the user folder were not renamed or deleted, it is a sign that the ransomware did not start up or perform any encryption. This behavior can happen for many reasons; for example, the ransomware is outdated, the remote website the ransomware software attempts to connect to is no longer active, it has detected that it is running in a virtual machine, or it has detected that the keyboard of the machine is Russian or Ukrainian.
  • Very small files (under approximately 6 KB) are not counted as encrypted by the detection engine. Make sure the test data set includes normal-sized user files.
  • If antivirus software is installed, it could block the ransomware. You should disable antivirus software and similar programs when testing.
  • Simulation software, such as RanSim from KnowBe4, cannot be used directly because EDR detects that it is originating from a safe application. Use the modified version available from Datto instead. Refer to Can I test ransomware detection?
  • If none of the above explained the missing alert, contact Kaseya Support.

The ransomware detection log is stored on protected endpoints at %SYSTEMDRIVE%\ProgramData\Datto\Datto Rollback Driver\Logs\engine.log. Lines containing RWA PATTERN DETECTED indicate scans where ransomware detection identified a potential threat. A companion log, wrapper.log, in the same folder records agent-side communication and response activity.

You can also view details about ransomware alerts from your EDR portal. For more information, refer to Working with the Alerts page.

 

Revision Date
How should I format exclusions? Edited answer. 6/18/25
Changed Supported operating systems to Compatibility: Edited - Ransomware Detection supports Windows 10 and above and Windows Server 2012 and above. 11/18/25
Global review, edits. 12/17/25
Technical review against agent source: documented Rollback service deployment in low-overhead mode when Enhanced detection is enabled with File Recovery disabled; corrected detection log guidance (RWA PATTERN DETECTED, wrapper.log); clarified transient-file wait, minimum encrypted-file size, drive exclusions (USB/FAT32), and cache retention maximum; fixed typos. 8/5/26