Prinz Eugen Ransomware - Credential Dumping via ManageEngine

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•1

Detects potential credential dumping activity where ManageEngine ADSelfService processes initiate other processes commonly associated with credential dumping, such as taskmgr.exe, lsass.exe, winlogon.exe, or wlrmdr.exe. This behavior could indicate an adversary attempting to extract credentials.