Prinz Eugen Ransomware servertool.exe Executed with --delete Flag
Detects execution of the Prinz Eugen Go-based ransomware binary (servertool.exe) with the --delete flag, which instructs the encryptor to remove original plaintext files after encryption. The binary is known to execute from user-writable paths such as Music and OneDrive directories.
Microsoft Sentinel (KQL)
