Prinz Eugen Ransomware - ManageEngine Endpoint Central Malicious Installation

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•3

Detects suspicious installation attempts of ManageEngine Endpoint Central (ADSelfService.exe) potentially associated with Prinz Eugen ransomware. The rule looks for silent installation parameters or execution initiated by PowerShell or Cmd.exe, which could indicate malicious deployment.