Case study: How predictive shielding in Defender stopped GPO-based ransomware before it started