{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "SafePay is a highly active ransomware variant targeting critical infrastructure. Identifying lateral movement before the impact stage (encryption) is the only way to prevent large-scale data loss and operational downtime." }, "name": "SafePay: Internal Discovery and Lateral Movement", "type": "investigation", "labels": [ "hunt", "attack.t1059.001", "attack.t1059.003", "attack.t1021.001", "attack.t1021.002", "attack.t1021.006", "attack.t1569.002", "attack.t1685", "attack.t1027.002", "defense evasion", "discovery", "exfiltration", "impact", "initial access", "lateral movement", "persistence", "privilege escalation" ], "series": { "slug": "stopransomware-safepay-ransomware", "index": 2, "title": "#StopRansomware: SafePay Ransomware", "total": 3 }, "related": [ { "hunt": "safepay-initial-access-exploitation", "reason": "This hunt assumes the attacker has already gained a foothold via VPN or edge vulnerability exploitation.", "relation": "precedes" }, { "hunt": "safepay-exfiltration-encryption", "reason": "Once lateral movement is complete, the attacker will proceed to data collection and encryption.", "relation": "follows" }, { "hunt": "safepay-external-access-identity-consolidation", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule for PsExec or AnyDesk creates excessive noise in environments where these are used legitimately. This hunt provides the necessary context by correlating tool execution with share discovery scripts and rare network patterns, allowing an analyst to distinguish between administrative work and an active intrusion.", "coverage": [ { "stage": "discovery-share-enumeration", "steps": [ "identify-living-off-land-tools", "hunt-malicious-scripting" ], "status": "covered" }, { "stage": "lateral-movement-rmm-psexec", "steps": [ "identify-living-off-land-tools", "examine-remote-service-traffic" ], "status": "covered" }, { "stage": "defense-evasion-security-impairment", "reason": "The 'defender_tamper_script_block' rule already monitors for Set-MpPreference and DisableRealtimeMonitoring commands.", "status": "existing_rule" }, { "stage": "initial-access-exploitation-and-brute-force", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "persistence-account-manipulation", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "privilege-escalation-uac-bypass", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "collection-exfiltration-utilities", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "impact-encryption-recovery-inhibition", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Edge Device Exploitation and Brute Force", "slug": "initial-access-exploitation-and-brute-force", "tactic": "initial-access", "techniques": [ "T1190", "T1110", "T1133" ], "observables": [ "CVE-2020-3259", "CVE-2023-20269", "CVE-2023-27532", "CVE-2024-40711", "CVE-2024-40766", "Mullvad VPN IP addresses", "VPN authentication failures" ] }, { "name": "Account Persistence and Privilege Gain", "slug": "persistence-account-manipulation", "tactic": "persistence", "techniques": [ "T1098", "T1136" ], "observables": [ "net user /add", "Password changes for existing system users", "Creation of new administrative accounts" ] }, { "name": "Local Privilege Escalation", "slug": "privilege-escalation-uac-bypass", "tactic": "privilege-escalation", "techniques": [ "T1548.002", "T1134.001" ], "observables": [ "UAC bypass via COM component objects", "Token impersonation activity" ] }, { "name": "Active Directory and Share Discovery", "slug": "discovery-share-enumeration", "tactic": "discovery", "techniques": [ "T1059.001", "T1059.003" ], "observables": [ "ShareFinder.ps1", "SharpShares.exe", "NetExec" ] }, { "name": "Lateral Movement and Remote Management", "slug": "lateral-movement-rmm-psexec", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1021.002", "T1021.006", "T1569.002" ], "observables": [ "psexec.exe", "winrm.exe", "AnyDesk.exe", "TeamViewer.exe", "ScreenConnect", "RDP connections" ] }, { "name": "Defense Impairment and Stealth", "slug": "defense-evasion-security-impairment", "tactic": "defense-evasion", "techniques": [ "T1685", "T1027.002" ], "observables": [ "Set-MpPreference -DisableRealtimeMonitoring", "Disabling security software", "Software packing or VM protection" ] }, { "name": "Data Collection and Exfiltration", "slug": "collection-exfiltration-utilities", "tactic": "exfiltration", "techniques": [ "T1560.001", "T1048", "T1567", "T1567.002" ], "observables": [ "7z.exe", "WinRAR.exe", "rclone.exe", "FileZilla.exe", "WinSCP.exe", "b2.exe (Backblaze)", "OneDrive exfiltration" ] }, { "name": "Encryption and Recovery Inhibition", "slug": "impact-encryption-recovery-inhibition", "tactic": "impact", "techniques": [ "T1486", "T1490", "T1070.004" ], "observables": [ ".SafePay extension", "vssadmin.exe delete shadows", "Resetting NAS to factory settings", "Self-deletion of ransomware binary" ] } ], "summary": "SafePay ransomware actors gain initial access through credential harvesting, brute-force attacks, and exploitation of vulnerabilities in VPN and edge devices like Cisco and Veeam. Once inside, they escalate privileges via UAC bypass, move laterally using RDP and PsExec, and utilize RMM tools for persistence before exfiltrating data and deploying encryption." }, "severity": "high", "rationale": "Start with workstations exhibiting unusual outbound RDP or WinRM traffic. Focus on systems where Windows Defender alerts have recently cleared or where 'Real-time monitoring' is reported as disabled.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using legitimate administrative tools and scripts to enumerate network shares and move laterally via remote management protocols while disabling local security software.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific hosts to narrow the hunt; leave empty for the entire estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "discovery_tools": { "from": { "ref": "AA26-293A", "kind": "article", "observed": "2026-10-20" }, "type": "list[string]", "default": [ "psexec.exe", "psexec64.exe", "winrm.exe", "anydesk.exe", "teamviewer.exe", "sharpshares.exe", "netexec.exe", "screenconnect.exe", "b2.exe", "acronisdiskdirector.exe" ], "description": "Process names of tools used by SafePay for discovery and movement." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a", "name": "CISA AA26-293A: #StopRansomware: SafePay Ransomware" } ], "blind_spots": [ { "id": "missing-endpoint-visibility", "risk": "Adversaries may pivot from an unmanaged beachhead to managed servers, remaining invisible until they touch a managed resource.", "stage": "discovery-share-enumeration", "question": "Are there domain-joined hosts not running an agent that are performing share enumeration?", "requires": "endpoint agent coverage on all domain-joined hosts" }, { "id": "obfuscated-scripts", "risk": "A simple string match on common cmdlets can be bypassed by character replacement or encoding.", "stage": "defense-evasion-security-impairment", "question": "Are the enumeration scripts using base64 or other obfuscation that avoids the LIKE filters?", "requires": "hb_script_activity with full block reconstruction" } ] }, "name": "SafePay: Internal Discovery and Lateral Movement", "description": "This hunt focuses on the middle phase of a SafePay ransomware intrusion. SafePay actors use living-off-the-land binaries (LOLBins) like PsExec and WinRM alongside legitimate RMM tools such as AnyDesk and ScreenConnect to pivot through the network. They concurrently use PowerShell scripts like ShareFinder to identify valuable assets and modify Windows Defender settings to avoid detection. The hunt identifies the execution of these tools, correlates them with suspicious script content, and examines network traffic to remote management ports." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "stopransomware-safepay-ransomware", "index": 2, "title": "#StopRansomware: SafePay Ransomware", "total": 3 }, "coverage": [ { "stage": "discovery-share-enumeration", "steps": [ "identify-living-off-land-tools", "hunt-malicious-scripting" ], "status": "covered" }, { "stage": "lateral-movement-rmm-psexec", "steps": [ "identify-living-off-land-tools", "examine-remote-service-traffic" ], "status": "covered" }, { "stage": "defense-evasion-security-impairment", "reason": "The 'defender_tamper_script_block' rule already monitors for Set-MpPreference and DisableRealtimeMonitoring commands.", "status": "existing_rule" }, { "stage": "initial-access-exploitation-and-brute-force", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "persistence-account-manipulation", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "privilege-escalation-uac-bypass", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "collection-exfiltration-utilities", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "impact-encryption-recovery-inhibition", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using legitimate administrative tools and scripts to enumerate network shares and move laterally via remote management protocols while disabling local security software.", "blind_spots": [ { "id": "missing-endpoint-visibility", "risk": "Adversaries may pivot from an unmanaged beachhead to managed servers, remaining invisible until they touch a managed resource.", "stage": "discovery-share-enumeration", "question": "Are there domain-joined hosts not running an agent that are performing share enumeration?", "requires": "endpoint agent coverage on all domain-joined hosts" }, { "id": "obfuscated-scripts", "risk": "A simple string match on common cmdlets can be bypassed by character replacement or encoding.", "stage": "defense-evasion-security-impairment", "question": "Are the enumeration scripts using base64 or other obfuscation that avoids the LIKE filters?", "requires": "hb_script_activity with full block reconstruction" } ], "scoping_notes": "Start with workstations exhibiting unusual outbound RDP or WinRM traffic. Focus on systems where Windows Defender alerts have recently cleared or where 'Real-time monitoring' is reported as disabled.", "beyond_detection": "A single detection rule for PsExec or AnyDesk creates excessive noise in environments where these are used legitimately. This hunt provides the necessary context by correlating tool execution with share discovery scripts and rare network patterns, allowing an analyst to distinguish between administrative work and an active intrusion." } }, { "id": "identify-living-off-land-tools", "type": "query", "label": "Identify administrative and RMM tools", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, parent_process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, process_path, parent_process_name, process_cmd_line, device_hostname HAVING COUNT(DISTINCT device_hostname) <= 3", "surface": "hb_process_activity", "description": "Find the execution of tools SafePay uses for lateral movement and host enumeration, filtering for rare occurrences.", "expected_signal": "Rows show legitimate tools running in unusual contexts, such as from user profiles or by unauthorized users, limited to rare sightings across the fleet." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Identify administrative and RMM tools", "reads": [ "device_hostname", "parent_process_name", "process_cmd_line", "process_name", "process_original_file_name", "process_path", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, parent_process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{discovery_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, process_path, parent_process_name, process_cmd_line, device_hostname HAVING COUNT(DISTINCT device_hostname) <= 3", "silence": "not_evidence_of_absence", "expected": "Rows show legitimate tools running in unusual contexts, such as from user profiles or by unauthorized users, limited to rare sightings across the fleet.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name", "process_cmd_line" ], "rare_below": 4 }, "verified_at": "2026-10-22" } }, { "id": "hunt-malicious-scripting", "type": "query", "label": "Search for share discovery and enumeration scripts", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, script_name, script_content, actor_user_name, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%sharefinder%' OR LOWER(script_content) LIKE '%get-netshare%' OR LOWER(script_content) LIKE '%invoke-sharefinder%' OR LOWER(script_content) LIKE '%netshareenum%' OR LOWER(script_content) LIKE '%get-adcomputer%' OR LOWER(script_content) LIKE '%ldap://%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Locate PowerShell activity targeting network shares or performing Active Directory enumeration to identify valuable assets.", "expected_signal": "Script blocks containing ShareFinder functions or AD query commands. Silence suggests no such scripts were executed within the window." }, "parents": [ { "id": "identify-living-off-land-tools" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Search for share discovery and enumeration scripts", "reads": [ "actor_user_name", "device_hostname", "script_content", "script_name", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_name, script_content, actor_user_name, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%sharefinder%' OR LOWER(script_content) LIKE '%get-netshare%' OR LOWER(script_content) LIKE '%invoke-sharefinder%' OR LOWER(script_content) LIKE '%netshareenum%' OR LOWER(script_content) LIKE '%get-adcomputer%' OR LOWER(script_content) LIKE '%ldap://%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Script blocks containing ShareFinder functions or AD query commands. Silence suggests no such scripts were executed within the window.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "examine-remote-service-traffic", "type": "query", "label": "Identify remote service connections", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_port, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port IN (3389, 5985, 5986) OR LOWER(process_name) LIKE '%anydesk%' OR LOWER(process_name) LIKE '%teamviewer%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_port HAVING COUNT(DISTINCT device_hostname) <= 3", "surface": "hb_network_connection", "description": "Stack-count network connections to remote management ports used for lateral movement.", "expected_signal": "A small number of hosts connecting to RDP or WinRM ports, or using RMM software. Rare connections stand out from normal administrative baseline." }, "parents": [ { "id": "identify-living-off-land-tools" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Identify remote service connections", "reads": [ "device_hostname", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_port, COUNT(*) AS connections, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_port IN (3389, 5985, 5986) OR LOWER(process_name) LIKE '%anydesk%' OR LOWER(process_name) LIKE '%teamviewer%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_port HAVING COUNT(DISTINCT device_hostname) <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A small number of hosts connecting to RDP or WinRM ports, or using RMM software. Rare connections stand out from normal administrative baseline.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name", "dst_endpoint_port" ], "rare_below": 4 }, "verified_at": "2026-10-22" } }, { "id": "triage-lateral-movement", "type": "analytic", "label": "Triage lateral movement evidence", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "identify-living-off-land-tools", "hunt-malicious-scripting", "examine-remote-service-traffic" ], "objective": "Identify hosts used for lateral pivots.", "description": "Synthesize the findings from process, script, and network surfaces to determine if a host is being used for lateral pivots.", "max_iterations": 5, "expected_signal": "A detailed verdict per host classifying the activity as malicious if multiple surfaces show corroborating indicators of discovery and movement.", "success_criteria": "A verdict of malicious, suspicious, or benign per host with cited evidence." }, "parents": [ { "id": "hunt-malicious-scripting", "kind": "merge" }, { "id": "examine-remote-service-traffic", "kind": "merge" } ] }, { "id": "evaluate-threat-presence", "type": "checkpoint", "label": "Evaluate threat presence", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host", "condition": "the triage verdict is malicious for at least one host", "blind_spot": "missing-endpoint-visibility", "confidence": "high", "description": "Route the hunt based on the agent verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-lateral-movement" } ] }, { "id": "isolate-compromised-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Halt lateral movement by containing the affected hosts.", "instructions": "Isolate the host and initiate a full forensic review of the user sessions active during the detected window.", "action_approval": "required" }, "parents": [ { "id": "evaluate-threat-presence", "branch": "on_supports" } ] }, { "id": "analyst-investigation", "type": "task", "label": "Analyst investigation", "config": { "assignee": "analyst", "description": "Verify the agent's findings and identify additional lateral movement paths.", "instructions": "Review the cited process command lines and script content. Cross-reference with hb_auth_signin to identify the originating source IP of the lateral movement attempts." }, "parents": [ { "id": "evaluate-threat-presence", "branch": "default" }, { "id": "evaluate-threat-presence", "branch": "on_unavailable" }, { "id": "isolate-compromised-host" } ] }, { "id": "reporting-and-cleanup", "type": "task", "label": "Reporting and cleanup", "config": { "assignee": "analyst", "description": "Finalize the hunt and record findings.", "instructions": "Document all discovered lateral movement paths and recommend tuning for the RMM tool detection candidate if the findings were verified." }, "parents": [ { "id": "evaluate-threat-presence", "branch": "on_refutes" }, { "id": "analyst-investigation" } ] } ] }