Prinz Eugen Ransomware - Process Deletion for Anti-Forensics
This rule detects the execution of 'cmd.exe' with command-line arguments indicative of file deletion, specifically targeting files or directories commonly associated with ransomware activity or anti-forensics. The rule looks for deletion commands ('del', 'erase', 'remove', 'delete') combined with specific file paths or executables ('servertool.exe', 'encrypt.exe', 'Music\', 'Desktop\'). This behavior is often observed in ransomware attacks to remove traces or critical files.
Microsoft Sentinel (KQL)
