1. A method for detecting one or more attacks in a network, wherein one or more processors in one or more network monitoring computers (NMCs) execute instructions to perform actions, comprising: instantiating one or more network monitoring engines to passively monitoring one or more network flows using the one or more NMCs; and responsive to the one or more network monitoring engines detecting one or more file write command operations based on information included in one or more packets of the one or more network flows, performing further actions, including: instantiating a packet capture engine to selectively store captured portions of the one or more packets in a non-transitory storage medium; instantiating an attack detection engine to perform actions, including: executing one or more detection rules to analyze one or more portions of the one or more stored packets to identify file information that is associated with the one or more file write command operations; and providing one or more metrics based on the one or more detection rules and a comparison of the one or more of the file information or the one or more file write command operations; and responsive to one or more of the one or more metrics exceeding one or more threshold values, performing actions including: capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations; storing one or more read packet portions of the one or more read packets in one or more memory buffers; extracting one or more portions of file data from the one or more stored read packet portions; providing one or more files based on the one or more extracted portions of file data; and providing one or more reports of one or more attacks based on the one or more exceeded threshold values.