monitor file access - ransomware detection

[xanadu]

In the hunt in detecting cryptolocker alike malware I'm looking for a way to detect abnormal file access behaviour.

I already placed one dummy.docx file where I check modification access and it's checksum, but this is only within one directory and hasn't proved to be effective as we had a cryptolocker inside another directory.

Is there a way where we can enable zabbix to monitor abnormal file access / changes which are in automated way?

All ideas are welcome!

[xanadu]

Is there anything we could do with running sysinternals process explorer and using it virustotal.com functionality?

[ServicedeskITS]

I think using Zabbix for this is not ideal.
Coz when it happens you are too late.

Best thing as far as i know is to use File System Resource Manager on Windows Server
This will prevent files from being changed to a different extension and hopefully also for the file from being infected as well.

[Wasur]

I think using Zabbix for this is not ideal.
Coz when it happens you are too late.

Best thing as far as i know is to use File System Resource Manager on Windows Server
This will prevent files from being changed to a different extension and hopefully also for the file from being infected as well.

Thank you! Very helpful
http://manual-removal.com/crypt0l0cker-2017/