1. A method for detecting ransomware in a computer system comprising computing hardware that includes a processor and data store, a user input device and a display device, and an operating system executable on the computing hardware, the operating system including a user interface module interfaced with the user input device and the display device, the method comprising: monitoring a current user behavior pattern based on usage of a user input device; comparing the user behavior against a predefined reference set of behavior patterns defined as input sequences receivable via the user input device representing expected user responsiveness to interruption of normal user interactivity with the user interface module; monitoring a current status pattern of the operating system; comparing the current status pattern against a reference set of operating system status patterns associated with predefined ransomware behavior including interference with operating system responsiveness to user input; in response to a result of the comparing of the current user behavior pattern against the reference set of behavior patterns being indicative of an interruption of normal user interactivity with the user interface module, and further in response to a result of the comparing of the current status pattern against the reference set of operating system status patterns being indicative of the current status pattern having a correlation to the predefined ransomware behavior, providing an indication of a positive detection of ransomware executing on the computer system.