Attackers attack for a reason. For targets like my servers, they mostly want to install mining software or a DDoS bot. This is detectable via cpu or network monitoring.

I assume if someone wanted to extort money from me after encrypting the disks on my servers, I would also be somehow informed.