What would you look for to catch ransomware before the encryption starts?

Encryption is the last step, so target the stages before it: initial access through exposed remote services or phishing, credential dumping, lateral movement toward a domain controller, discovery commands, and defense evasion such as disabling security tooling. High value tells include volume shadow copy deletion, backup agent tampering, mass file access from one host, and a scheduled task or policy change pushing an executable to many machines.

By the time files are encrypting you have already lost, so I detect the days before. The chain is usually access through an exposed remote service or a phishing payload, then credential theft, then movement toward a domain controller, then staging. The highest fidelity signals I have alerted on are shadow copy deletion through vssadmin or wmic, tampering with or stopping endpoint protection and backup agents, and discovery bursts: enumerating domain administrators, nltest, and share enumeration from a workstation that has never done it. Mass file reads and renames over SMB from one host is a late but still actionable signal. Deployment is often a scheduled task or a group policy change pushing an executable everywhere, so I watch policy modification closely, because that is the point where one host becomes eight hundred. If I see shadow copy deletion I do not wait for confirmation. I isolate immediately and escalate, because the cost of being wrong is one annoyed user versus a company wide outage.