Prinz Eugen Ransomware - ChaCha20 Encryption Indicator - File Extension Modification Pattern

Ankit Mehta@Secvyn

•updated Jun 23, 2026•7•0•14

This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.