Tagged ransomware detection