Creating check for Windows FileServer to see if a cryptotrojaner is running

Most likely you need to create your own custom check for this.

On the fileserver whenever this is a *nix based system you might would like to check iostat output, specially the %util column (last one), on my test system nothing is going on here.

iostat -dx
Linux 3.10.0-1062.4.3.el7.x86_64 (arrakis)      12/19/2019      _x86_64_        (4 CPU)

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s avgrq-sz avgqu-sz   await r_await w_await  svctm  %util
vda               0.00     0.00    0.01    0.06     0.38     0.67    27.09     0.00    4.19    2.95    4.46   0.43   0.00
scd0              0.00     0.00    0.00    0.00     0.00     0.00   114.22     0.00    0.89    0.89    0.00   0.67   0.00
dm-0              0.00     0.00    0.01    0.06     0.37     0.64    27.10     0.00    4.81    2.98    5.22   0.50   0.00
dm-1              0.00     0.00    0.00    0.00     0.00     0.00    50.96     0.00    1.06    1.06    0.00   0.95   0.00