Miss 123 [new]
IF host_process_writes_encrypted_files > threshold AND multiple_user_accounts_triggered_within_5min THEN generate_alert(severity=high, type=ransomware-suspected)
IF host_process_writes_encrypted_files > threshold AND multiple_user_accounts_triggered_within_5min THEN generate_alert(severity=high, type=ransomware-suspected)