Nicely done this one

According to ESET tech documents, Ransomware Shield is supposed to show a notification to let users decide what to do when it detects ransomware activity. But I'm not sure if anyone ever saw it in action:
Have you checked if Avast, BD, etc. can detect the tested sample when certutil is already blocked?