Abstract: Ransomware attacks on computing devices can be thwarted by monitoring runtime execution data associated with processes on a device through an agent. When the agent determines, based on this data, that a process is likely associated with ransomware or other malicious activity—such as by detecting system-call events indicative of file-system encryption or authentication anomalies—it can suspend the process by issuing a kernel-mode thread suspension request that atomically halts all threads. Information about the process can be packaged and later utilized to thwart current and future malicious activity.