A method, computer program product, and computing system for processing a plurality of operations on a storage object within a file storage system at a file level. The plurality of operations are monitored for at least a threshold number of file modification operations within the file storage system. In response to monitoring the at least a threshold number of file modification operations within the file storage system, file modification information associated with the at least a threshold number of file modification operations is provided to a block level of the file storage system. A potential ransomware attack on the file storage system is identified, at the block level, based upon, at least in part, the file modification information provided from the file level.