Hello everyone,
I have an alert from CommVault that says:
- Description: A suspicious file [D:\ArielDB\Customers\APS\Ariel\Sets\Prd\Temp\hwot5ftk.afd] is detected on the machine [SRV-PRDP101]. Please alert your administrator.
I read in https://documentation.commvault.com/commvault/v11_sp20/article?p=7879_1.htm that “A Honeypot file placed by Commvault mimics this user document and baits ransomware into encrypting this file.”
This server is a virtual machine that acts as a file server for our production system and has the “restore only” client installed. Because it is the restore only client, I believe that there’s no way for CommVault to place a honeypot file there to check for malware encryption. Is this correct? Is there a way to check the honeypot file(s) placed on a server by CommVault?
Ken