Detection engineering that catches ransomware before encryption: watch VSS deletion, GPO payload pushes, and mass service ...