Checking for files that suddenly become encrypted. i.e. suspicious activity...
This is a very simple proof of concept that shows how you might check specific file attributes using a basic PowerShell script.
Be sure to edit the paths in the script to fit your environment.