Prinz Eugen Ransomware File Activity

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

This rule detects suspicious file activity indicative of Prinz Eugen ransomware. It looks for the creation of multiple files (100 or more) with the '.prinzeugen' extension and a file size of at least 1KB, which suggests encryption activity.