Ransomware Activity - Prinzeugen Extension
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule aggregates these file events by device and time, triggering an alert if 10 or more such files are observed within an hour on a single device, indicating a bulk encryption event.
Microsoft Sentinel (KQL)
