You can use the file
command if available in your environment (a standard part of BSD/OSX/Linux). For example, once encrypted content is available:
$ gpg --encrypt test-encrypted -r sample@sample.com
Enter the user ID. End with an empty line:
$ ls
test-encrypted test-encrypted.gpg
$ mv test-encrypted.gpg testfile.txt
file
can identify it as GPG Encrypted content:
$ file testfile.txt
testfile.txt: GPG encrypted data
However, this only shows information based on the headers and trailers. A while back, someone wrote a Powershell script to find Cryptolocker files (link to PS script) which may or may not help you. The issue you will run into is: "HOW was this encrypted?" For example, if an attacker just creates a complex password for a "password protected zip" file, that isn't encryption per-se, so your script will be detected as a zip file, not an encrypted file.
Also noteworthy is, many of these ransomware files change on every iteration. E.g., locky appends a *.locky to each file, so while some may be easy to detect, imagine if all your files were renamed to random checksums. Now you cannot identify files: E.g.:
MD5 ("salesfile") = 64d11ab29c2d78b325d8a944119d1150.doc
MD5 ("payrollfile") = d9087b158cd38e844999456d17611f1c.doc
MD5 ("engineeringfile") = 14e8e9011a4d3343df39e35fc7f2cd29.doc
MD5 ("researchfile") = 26779202429523339305a90e6ec74146.doc
MD5 ("managementfile") = 419765bc586cdd1bf741afe771951bec.doc
Now you have a bigger issue. Which file is more mission critical to spend time "cracking/decrypting/etc." For the most part, the file command on Unix based systems, and or the Powershell script should give you a starting point. There is also YARA if you REALLY want to be technical about it. Create a YARA signature, and use that to search.