Prinz Eugen Ransomware - Mass File Creation w/ Unknown Extensions

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule monitors Sysmon Event ID 11 (FileCreate) to detect high-volume file creation activity across multiple unique directories. By filtering out common file types, it identifies potential signs of mass file modification, staging for exfiltration, or malicious encryption characteristic of ransomware or data destructive operations.