RansomWhere is a free generic ransomware detection tool for Mac OS X users that can identify ransomware-like behavior by continually monitoring the file-system for the creation of encrypted files by suspicious processes. Patrick Wardle, a former NSA staffer who now leads research outfit Synack, has developed the tool. Wardle successfully tested the tool against KeRanger as well as Gopher ransomware proof-of-concept, which was developed by a pro-Apple Mac hacker, Pedro Vilaca, last year.
Source: https://thehackernews.com/2016/04/ransomware-detection-tool.html