Windows Process Creation: Snatch Ransomware Dropper Safe-Mode Reboot Indicators

Alerts on Windows process command lines showing instant safe-mode shutdown/reboot and stopping SuperBackupMan service.

FreeUnreviewedSigmahighv1

windows-process-creation-snatch-ransomware-dropper-safe-mode-reboot-indicators-5325945e

title: "Windows Process Creation: Snatch Ransomware Dropper Safe-Mode Reboot Indicators"
id: 1ba4c817-0901-47ca-bc45-afffb190e3ed
status: stable
description: This rule flags Windows process creation events where command-line arguments indicate immediate shutdown with a reboot into safe mode and stopping a specific service name. These behaviors matter because they align with pre-encryption tooling that attempts to disrupt protections and restart the host quickly. Detection relies on process creation telemetry with accessible command-line arguments matching the specified shutdown and service-stop patterns.
references:
  - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Snatch/proc_creation_win_malware_snatch_ransomware.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-08-26
modified: 2025-10-19
tags:
  - attack.execution
  - attack.t1204
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|re: shutdown\s+/r /f /t 00
    - CommandLine|re: net\s+stop SuperBackupMan
  condition: selection
falsepositives:
  - Scripts that shutdown the system immediately and reboot them in safe mode are unlikely
level: high
license: DRL-1.1
related:
  - id: 5325945e-f1f0-406e-97b8-65104d393fff
    type: derived

What it detects

This rule flags Windows process creation events where command-line arguments indicate immediate shutdown with a reboot into safe mode and stopping a specific service name. These behaviors matter because they align with pre-encryption tooling that attempts to disrupt protections and restart the host quickly. Detection relies on process creation telemetry with accessible command-line arguments matching the specified shutdown and service-stop patterns.

Known false positives

Scripts that shutdown the system immediately and reboot them in safe mode are unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.