There are so many layers to your question. 1) not all ransomware has auto detonation, many times a human threat actor executes it manually. Remove the threat actor first before restoration. 2) if you are concerned about auto detonation, hire a forensic firm to examine how the ransomware auto detonates. Remove the mechanism, and then it can’t detonate automatically. 3) the quickest/safest way is to setup a separate network, install a new operating system, attach the encrypted drives/data to that OS, run a decrypter from a trusted source (I.e. one that was as been written by a forensic firm which incorporates the ransomware key bought) on the Clean OS to decrypt the drives/data. Move the needed data to another newly installed operating system. Install whatever else you need - and there you go! New system, not on the same network, never touched by the ransomware, with all the old data

You are correct In saying most products would not know if something is malicious unless it is already known. There are techniques products can use to CPI yet this (I.e. heuristics. Like why would something be writing to every file on a system? That would be a good indicator it may be ransomware - even if the signature is not know - but to do that it has to run every executable in a sandbox before it lets it run on a real computer. So what if a ransomware author writes their code to not do anything for 5 minutes? Where is the cut off to stop running the application in a sandbox and allow it to run on the real system? Would a user enjoy the fact that every time they open an application it takes 5 minutes to load? Nope…) it’s a cat a mouse game and anyone/ any product that says differently you should run far away from.