Tremor

Replaces an earlier, partially-completed static malware-analysis project in this workspace. RansomWatch is a passive, host-based behavioral detector for ransomware-like file transformations: it analyzes live-monitored directories or replayed JSONL event logs using seven independent, explainable detection rules (entropy transitions, bulk renames, extension churn, cross-directory spread, delete-and-replace sequences, ransom-note-like artifacts, and decoy-file mutation), with severity computed from which rules are jointly active rather than a numeric score. Every default threshold is grounded in real, cited prior art -- Objective-See's open-source RansomWhere? detector and the CryptoDrop research (Scaife et al., ICDCS 2016) -- and documented as such rather than presented as an invented or universal standard. The test suite (39 pytest tests, fully offline) includes real documented false-positive classes (a 7-Zip-equivalent case, CryptoDrop's own benign batch-image-processing benchmark, and a deliberately-crossing backup-software case kept as an honestly disclosed limitation) and real documented evasions (low-and-slow, partial-encryption sampling miss, entropy-reshaping, per-process splitting) that the detector is expected NOT to catch. No real ransomware, encryption routine, or malware sample exists anywhere in the repository.