There's a fantastic free tool called RansomWhere by Objective-See that I use to monitor the rapid creation of encrypted files on my Mac. It notifies me from time to time during installation processes that something possibly malicious is going on.

Link: https://objective-see.com/products/ransomwhere.html