Ransomware Activity - Prinzeugen Extension

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•2

This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.