Prinz Eugen Ransomware - Multiple Directory Traversal

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•3

This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.