Prinz Eugen — Go-based Ransomware Hunt & Hardening Pack

Looks for: the Prinz Eugen encryptor by name, by published SHA-256, by its encrypter usage string, or any executable run from a profile Music folder. Accomplishes: the highest-fidelity impact signal. FP: low — a binary launching from \Music\ is almost always suspect.

// HUNT: Prinz Eugen encryptor execution (T1486)
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 w/ CommandLine + hashes
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^servertool\.exe$/i
   or SHA256HashData=/^686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4$/i
   or ImageFileName=/\\Users\\[^\\]+\\Music\\[^\\]+\.exe$/i
   or CommandLine=/usage:\s*encrypter|--delete\s+[A-Za-z]:\\/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, SHA256HashData, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: local account creation and Administrators-group additions — Prinz Eugen uses net user admin germania /add. Accomplishes: catches the persistence/privesc step. FP: legitimate IT account provisioning — allow-list sanctioned admin AIDs / build hosts.

// HUNT: Prinz Eugen rogue local admin (T1136.001 / T1098)
// CONF: medium  FP: medium  COST: low
// TUNING: exclude provisioning/build AIDs; the literal "germania" pass is high-confidence
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/net\d?\s+user\s+\S+\s+\S+\s+\/add|net\d?\s+localgroup\s+administrators\s+\S+\s+\/add|net\s+user\s+\S+\s+germania/i
| groupBy([aid, ComputerName, UserName], function=[count(), collect([FileName, CommandLine], limit=20)])
| sort(_count, order=desc)

Looks for: PowerShell/command lines referencing the staging C2 IP or its scripts (serverscan.ps1, /stager/mini, /stager/ps1). Accomplishes: catches the tooling-download stage. FP: low — the IP is a strong atom; alert on any hit.

// HUNT: Prinz Eugen PowerShell stager download (T1059.001 / T1105)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/212\.80\.7\.74|serverscan\.ps1|stager\\?(mini|ps1)|(Invoke-WebRequest|iwr|curl|DownloadString).{0,40}212\.80\.7\.74/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: the ping 127.0.0.1 -n 2 delay chained to a force-delete — the classic self-removal stub Prinz Eugen uses post-encryption. Accomplishes: catches the anti-forensics stage, even if the binary is gone. FP: low — rarely benign; verify any hit.

// HUNT: Prinz Eugen self-deletion stub (T1070.004)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/ping(\.exe)?\s+(127\.0\.0\.1|localhost)\s+-n\s+\d+.{0,30}\bdel\b\s+\/[fFqQ]/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: files written/renamed with the .prinzeugen extension or the .tmp staging pattern, grouped by host to surface the encryption burst. Accomplishes: confirms impact (there is no note to find). FP: none expected for the extension; COST is medium because file events are high-volume — scope the window.

// HUNT: Prinz Eugen encrypted-file writes (T1486)
// CONF: high  FP: low  COST: medium | scope to a tight window for large estates
#event_simpleName=/PeFileWritten|RansomFileAccessInfo/
| TargetFileName=/\.prinzeugen$/i
| groupBy([aid, ComputerName], function=[count(as=encrypted_files), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(encrypted_files, order=desc)

Looks for: RemotePC (IDrive) RMM binaries running where that tool is not sanctioned. Accomplishes: catches the operator's remote-access tooling. FP: medium — RemotePC is legitimate where licensed; allow-list approved RMM hosts/AIDs and alert only on the rest.

// HUNT: Prinz Eugen RemotePC RMM abuse (T1219)
// CONF: medium  FP: medium  COST: low
// TUNING: exclude hosts/AIDs where RemotePC is an approved RMM
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(RemotePC|RemotePCService|RPCService|idrivedownloader|RemotePCDesktop)(\.exe)?$/i
| groupBy([aid, ComputerName, UserName, FileName], function=[count(), collect([CommandLine], limit=10)])
| sort(_count, order=desc)

Looks for: outbound connections to the staging C2 IP or DNS lookups of the actor's typosquat/fake-CAPTCHA/DDNS domains. Accomplishes: network-side confirmation independent of host artifacts. FP: low — perishable infra; alert and pivot to the process.

// HUNT: Prinz Eugen C2 / actor infrastructure (T1071 / T1041)
// CONF: high  FP: low  COST: low | infra is perishable — pivot to the host process
#event_simpleName=/NetworkConnectIP4|DnsRequest/
| (RemoteAddressIP4=/^212\.80\.7\.74$/
   or DomainName=/(stndrdbnk\.cc|g-captchafestung\.sbs|festung-e\.duckdns\.org)$/i)
| table([@timestamp, aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, DomainName], limit=200)
| sort(@timestamp, order=desc)