Hi there,
monitoring hdd usage is not the best way to protect against ransoftware. there are a couple of possibilities available like monitoring for specific behaviour or file type extensions. In windows theres a build-in option called FSRM with that you can do realtime monitoring and blocking of smb connections:
kind regards,
Constantin