ransomware

Hi,
I have been asked the following question:
is there anyway, from within postgres, to detect any ""abnormal"" disk
writing activity ?
obvious goal would be to alert if...
its quite clear that the underlying OS is the place to do the checks, but,
still

--to my understanding, a simple script can check various inner counters,
but this will imply that the "undesired" soft uses postgres to do the
crypting (any experience on this ???)
--another approach would be based on the fact that, if anything do change
any postgres file (data, current wal, ...) postgres should somehow "hang"

there are various ways to do those checks but I was wandering if any
""standard''" solution exist within postgres ecosystem, or someone do have
any feedback on the topic.

thanks for your help

Marc MILLAS
Senior Architect
+33607850334
www.mokadb.com