Maybe it would be a solution to extend BB to perform some basic format tests for popular file formats on write operations? For example when a process tries to write at position 0 to a JPEG file and written data doesn’t start with SOI, then BB should generate an alert, or PDF files should start with %PDF and end with %%EOF and so on.

I’ve been thinking of this for a while, but I don’t know that this is a viable option or it requires too much CPU and IO resources, and I have little knowledge about FSD filters (and even less free time) for a proof-of-concept implementation.

No, the behavior is always monitored locally, which means if the ransomware is executed on the server it is being detected but if it is executed on a client that just happen to have access to a folder remotely on a server, it isn’t. Therefore you should never rely on server side protection only but also install behavior blocking on all your clients that have access to the server.

Background: If ransomware encrypts files, it means it just edits existing files. A file write operation is not a malicious action though and therefore can’t be used as a trigger to alert. The behavior blocker monitors not just the file write action but also takes into account plenty of meta properties of the actual executable program that does the action, to come up with an alert.