Prinz Eugen Ransomware - Batch Encryption of Multiple File Types

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.