Prinz Eugen Ransomware - Cryptocurrency Payment Indicators

Ankit Mehta@Secvyn

•updated Jun 23, 2026•2•0•3

This rule detects processes that contain cryptocurrency-related keywords in their command line, specifically when initiated by common Windows executables like cmd.exe, powershell.exe, notepad.exe, or notepad++.exe. This behavior can indicate a ransomware infection attempting to display payment instructions or interact with cryptocurrency wallets.