Prinz Eugen Ransomware - Registry Run Key Persistence with Encoded Paths

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

Detects the creation or modification of registry run keys that establish persistence for the Prinz Eugen ransomware. The rule specifically looks for registry entries under 'Software\Microsoft\Windows\CurrentVersion\Run' that contain common environment variables (e.g., %APPDATA%, %TEMP%) and specific filenames or paths associated with Prinz Eugen ransomware (e.g., 'servertool', 'encrypt.exe', '\Music\', '\Desktop\').