Ransomware has an Achilles’ heel, yet few organizations are paying attention to the canary in the coal mine. Understanding normal versus abnormal behavior sheds light on the presence of ransomware performing reconnaissance before it strikes. This represents a great opportunity for defenders to get an early heads-up. This solution brief examines how organizations can leverage this knowledge.