ransomware

I have been asked the following question:

is there anyway, from within postgres, to detect any ""abnormal"" disk writing activity ?

obvious goal would be to alert  if...

its quite clear that the underlying OS is the place to do the checks, but, still

--to my understanding, a simple script can check various inner counters, but this will imply that the "undesired" soft uses postgres to do the crypting (any experience on this ???)

--another approach would be based on the fact that, if anything do change any postgres file (data, current wal, ...) postgres should somehow "hang"

there are various ways to do those checks but I was wandering if any ""standard''" solution exist within postgres ecosystem, or someone do have any feedback on the topic.

thanks for your help

Marc MILLAS