Would a RansomWhere application be possible for Windows too?

Question

This is related to RansomWhere? which is a OS X specific defense developed by a former NSA employee. The premise is that it will "generically" stop ransomware from encrypting files on the OS.

Scope

RansomWhere? only monitors all users' home directories (i.e. anything under ~, for all users) for encrypted files. Thus if the ransomware encrypts files outside these directories, RansomWhere? may fail to detect and block it.

It is allowed to run and install as it is signed by Apple and trusts:

Trust

RansomWhere? explicitly trusts binaries signed by Apple proper (though not ones signed with an Apple developer ID). As such, if ransomware abuses an signed Apple binary (or process, perhaps via injection), RansomWhere? would not detect this. Moreover, the tool inherently trusts applications that are already present on the system when it is installed. Thus is ransomware is already present on the system (before RansomWhere? is installed), it may not be detected.

Now this is fine and likely good as the premise is:

Let's try to generically thwart OS X ransomware via math!

Now the question is: "Could a similar application be developed for Windows?"

It seems that there is application/process whitelisting done where a baseline is established during the installation. But there is the rather significant addition of being able to trust signed installs, is that doable on Windows?

Answer 1

Already done - it's currently in beta.

Have a look at: Malwarebytes Anti Ransomware Beta.

Former times it was called CryptoMonitor developed by EasySync Solutions, owned by Nathan Scott. Nathan was recently hired to bring up the Anti Ransomware tool for Malwarebytes.

Answer 2

Of course it's possible and already in development as @Danny pointed out and you can assume that some big vendors will follow.

But in fact this is nothing more than another behavior driven anti virus solution. It's the same game as it is with any other protection solution:

It's being developed and deployed, some attacks will be mitigated, the attackers will have a look at the application to circumvent the protection and everything starts from the beginning.

In fact every software, especially such a complex and high privileged one like anti virus protection, will increase the attack surface. There were many cases in the past (for more sources have a search in the web) where the protection solution had vulnerabilities.