Dotnet has a class named FileSystemWatcher that is for having watch in a particular folder and sub folder (conditional), when a file created, modified, deleted or renamed , it fires respective event where we can implement our logic to prevent suspicious activity.
Programming Tutorials And Source Code - ASP.NET,C#.NET,MVC,JQuery,JavaScript,SQL Server,Angular,WCF examples