Prinz Eugen Ransomware - Multi-CPU Worker Process Indicators
This rule detects the execution of processes named 'servertool.exe' or 'encrypt.exe' that are likely associated with the Prinz Eugen ransomware. The detection logic specifically looks for these executables being run with command-line arguments indicative of multi-threaded or parallel processing, such as 'goroutine', 'threads', 'workers', or 'parallel'. It then counts the number of unique process IDs for these activities within a 5-minute window on a given device and flags if four or more such processes are observed, suggesting a high-intensity encryption operation.
Microsoft Sentinel (KQL)
