It depends. As with all modern encryption you have three main ways of action to decrypt something.
Attack a faulty implementation or algorithm
With ransomware, it is not uncommon that an very old implementation was used which may have a weakness and allows recovery of the the decryption key.
There is no single software solution for something like that, not one that I'm aware of anyway. It boils down to detecting the usage of a faulty and then writing your own tool based on a cryptolibary.
Attack the key or passphrase itself
Sometimes the decryption master key has leaked, was leaked intentionally or discovered by brute-forcing.
Rainbow Crack and John the Ripper can both be used for doing that. But it's likely that professional firms use home-brewed scripts and software for problems like this.
Hope that encryption was not applied to all data
Some ransomware was also know for only encrypting certain parts of a system, like the partition table - meaning that the data was still there, unencrypted - but the average user didn't have the knowledge on how to recover it.
In such a case, the Sleuthkit is a very useful collection of forensic tools that can be used for recovery.
As for detecting that a file is encrypted: Most software will simply detect it by the header. Modern encryption basically looks like random data.