Prinz Eugen: Encoded PowerShell with Hidden Window Spawned by RPCCMDHOST.EXE

Ethan Andrews@eandrews

•updated Jun 23, 2026•0•0•5

Detects the Prinz Eugen ransomware operator leveraging RemotePC's RPCCMDHOST.EXE to spawn PowerShell with hidden window, no profile, and non-interactive flags, consistent with obfuscated stager execution observed in active intrusions.