Prinz Eugen Ransomware - Drive Letter Enumeration Before Encryption

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

This rule detects potential Prinz Eugen ransomware activity by identifying instances where drive letter enumeration commands (wmic.exe logicaldisk, fsutil.exe fsinfo, diskpart.exe) are executed, followed within 30 minutes by the execution of known ransomware executables (servertool.exe, encrypt.exe) on the same device. This sequence of events suggests reconnaissance prior to data encryption.