Ransom Wars: Using behavioural analysis, we set an ambitious goal, to detect and mitigate ransomware at an early stage for our capstone project at Sheridan; through hard work, and dedication we achieved this goal. The presentation will detail all our findings, technical details, and results of this journey. Based on the recent prominence of malicious Ransomware as well as the significant damage it has caused, we hypothesized that this type of malware could be stopped in its tracks, or at least heavily mitigated, using behavioural indicators. A type of driver called a file system minifilter driver was used in order to monitor all transactions between processes and the file system. Based on an analysis of 85 ransomware samples, we compiled a list of common ransomware behaviours based on their interactions with the file system. Through the use of these indicators, in addition to tracking temporal file writes per process, we devised an algorithm and created software to identify and terminate processes deemed likely to be ransomware.