Ransomware endpoint protection