1. In a computer system comprising computing hardware that includes a processor and data store, a user input device and a display device, and an operating system executable on the computing hardware, the operating system including a user interface module interfaced with the user input device and the display device, a method for detecting ransomware, the method comprising: monitoring a current user behavior pattern based on user input via the user input device; comparing the user behavior against a reference set of behavior patterns associated with user frustration with non-responsiveness of the user interface module; monitoring a current status pattern of the operating system; comparing the current status pattern against a reference set of operating system status patterns associated with predefined ransomware behavior; in response to a result of the comparing of the current user behavior pattern against the reference set of behavior patterns being indicative of current user frustration with non-responsiveness of the user interface module, and further in response to a result of the comparing of the current status pattern against the reference set of operating system status patterns being indicative of the current status pattern having a correlation to the predefined ransomware behavior, providing an indication of a positive detection of ransomware executing on the computer system.