A method for detecting ransomware. A set of control files in a set of locations in a file system is checked, by a computer system, in response to an event, wherein the set of control files has a set of extensions targeted by the ransomware. In response to detecting a change in any of the set of control files, a file copying process for the file system is disabled by the computer system.