huntrule

Windows Process Creation Indicators for Snatch Ransomware Word Document Droppers

Alerts on Windows process command lines showing instant safe-mode shutdown/reboot and stopping SuperBackupMan service.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2020-08-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events matching command-line patterns associated with immediate reboot into safe mode and stopping a backup-related service. Such behavior is commonly used to hinder recovery and evade local protections before payload execution. It relies on process creation telemetry containing the full command line to identify the specific shutdown and service-stop arguments.

Reporting behind it

Related detections9 linkedT1204 — drag to rearrange
Malicious Edge Abuse for Payload Download via Console (via process_creation)
Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)
Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution
Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution
Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'
Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter
Windows Registry: Suspicious Space-Padded TypedPaths Details String
Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1
Windows: Deno writes files from remote HTTPS content into AppData
Windows Process Creation Indicators for Snatch Ransomware Word Document Droppers
Pivot detection · T1204 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.