This is related to RansomWhere? which is a OS X specific defense developed by a former NSA employee. The premise is that it will "generically" stop ransomware from encrypting files on the OS.
RansomWhere? only monitors all users' home directories (i.e. anything under ~, for all users) for encrypted files. Thus if the ransomware encrypts files outside these directories, RansomWhere? may fail to detect and block it.
It is allowed to run and install as it is signed by Apple and trusts:
RansomWhere? explicitly trusts binaries signed by Apple proper (though not ones signed with an Apple developer ID). As such, if ransomware abuses an signed Apple binary (or process, perhaps via injection), RansomWhere? would not detect this. Moreover, the tool inherently trusts applications that are already present on the system when it is installed. Thus is ransomware is already present on the system (before RansomWhere? is installed), it may not be detected.
Now this is fine and likely good as the premise is:
Let's try to generically thwart OS X ransomware via math!
Now the question is: "Could a similar application be developed for Windows?"
It seems that there is application/process whitelisting done where a baseline is established during the installation. But there is the rather significant addition of being able to trust signed installs, is that doable on Windows?