Ransomware Propagation Network Pattern Detection

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•4

This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.