Prinz Eugen Ransomware - Run Registry Persistence
Detects modifications to the 'Run' registry key for persistence, specifically looking for indicators associated with Prinz Eugen ransomware such as 'servertool', 'encrypt.exe', 'lock.exe', or 'ransom' in the registry value data. It excludes common legitimate paths to reduce false positives.
Microsoft Sentinel (KQL)
