We are implementing a product called Varonis to monitor for crypto activity from a specific user on Windows file shares. Varonis can trigger actions such as running scripts that will disable the account and disconnect the SMB session. Windows file share servers can be acted upon using PowerShell scripts to disconnect the user’s session and prevent further file system destruction.
Example of Microsoft Powershell script:
Does the HNAS have any method by which a user’s SMB session to a CIFS can be disconnected