{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "keep-as-periodic-hunt",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "SafePay is a high-impact ransomware group targeting critical infrastructure; detecting their lateral movement and internal discovery phase is the last opportunity to prevent large-scale encryption."
      },
      "name": "SafePay: Internal Enumeration and Lateral Movement",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1003",
        "attack.t1021.001",
        "attack.t1021.002",
        "attack.t1021.006",
        "attack.t1059.001",
        "attack.t1134.001",
        "attack.t1548.002",
        "attack.t1569.002",
        "defense evasion",
        "discovery",
        "exfiltration",
        "impact",
        "initial access",
        "lateral movement",
        "persistence",
        "privilege escalation"
      ],
      "series": {
        "slug": "stopransomware-safepay-ransomware",
        "index": 2,
        "title": "#StopRansomware: SafePay Ransomware",
        "total": 3
      },
      "related": [
        {
          "hunt": "safepay-initial-access",
          "reason": "This hunt examines the internal spread that occurs after the initial VPN or phishing breach.",
          "relation": "follows"
        },
        {
          "hunt": "safepay-impact-and-encryption",
          "reason": "Lateral movement and share discovery are the prerequisites for the mass encryption phase.",
          "relation": "precedes"
        },
        {
          "hunt": "safepay-perimeter-breach-account-persistence",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single detection rule for 'mimikatz.exe' is easily bypassed by renaming. This hunt correlates the rare presence of RMM tools (AnyDesk/TeamViewer) with the high-integrity execution of discovery binaries and anomalous authentication paths to find the actor even when tools are rotated.",
      "coverage": [
        {
          "stage": "discovery-and-credential-dumping",
          "steps": [
            "recon-tool-execution"
          ],
          "status": "covered"
        },
        {
          "stage": "lateral-movement-and-rmm-abuse",
          "steps": [
            "rmm-inventory",
            "lateral-auth-baseline"
          ],
          "status": "covered"
        },
        {
          "stage": "privilege-escalation-uac-bypass",
          "steps": [
            "recon-tool-execution"
          ],
          "reason": "The query includes common UAC bypass binaries such as fodhelper.exe and computerdefaults.exe and filters for high-integrity execution.",
          "status": "covered"
        },
        {
          "stage": "initial-access-vpn-and-phishing",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "persistence-via-account-manipulation",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "defense-evasion-and-stealth",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "exfiltration-and-collection",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "impact-and-encryption",
          "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "VPN Exploitation and Credential Access",
            "slug": "initial-access-vpn-and-phishing",
            "tactic": "initial-access",
            "techniques": [
              "T1190",
              "T1110",
              "T1133",
              "T1566"
            ],
            "observables": [
              "CVE-2020-3259",
              "CVE-2023-20269",
              "Mullvad VPN IP addresses",
              "Brute force password attacks"
            ]
          },
          {
            "name": "Account Creation and Privilege Gain",
            "slug": "persistence-via-account-manipulation",
            "tactic": "persistence",
            "techniques": [
              "T1098",
              "T1136"
            ],
            "observables": [
              "Creation of new administrative accounts",
              "Administrative privileges granted to existing accounts"
            ]
          },
          {
            "name": "Network Discovery and Credential Access",
            "slug": "discovery-and-credential-dumping",
            "tactic": "discovery",
            "techniques": [
              "T1059.001",
              "T1059.003",
              "T1003",
              "T1550.002"
            ],
            "observables": [
              "ShareFinder.ps1",
              "SharpShares.exe",
              "NetExec",
              "Mimikatz",
              "Kerberos ticket extraction"
            ]
          },
          {
            "name": "Remote Command Execution and Lateral Pivot",
            "slug": "lateral-movement-and-rmm-abuse",
            "tactic": "lateral-movement",
            "techniques": [
              "T1021.001",
              "T1021.002",
              "T1021.006",
              "T1569.002",
              "T1218"
            ],
            "observables": [
              "PsExec",
              "WinRM",
              "RDP",
              "ScreenConnect",
              "AnyDesk",
              "TeamViewer"
            ]
          },
          {
            "name": "UAC Bypass and Token Impersonation",
            "slug": "privilege-escalation-uac-bypass",
            "tactic": "privilege-escalation",
            "techniques": [
              "T1548.002",
              "T1134.001"
            ],
            "observables": [
              "Elevated process creation via COM component",
              "Token impersonation methods"
            ]
          },
          {
            "name": "Security Software Impairment and Stealth",
            "slug": "defense-evasion-and-stealth",
            "tactic": "defense-evasion",
            "techniques": [
              "T1685",
              "T1027.002",
              "T1070.004"
            ],
            "observables": [
              "Disabling security software",
              "Software packing or VM-based concealment",
              "Self-deletion from filesystem"
            ]
          },
          {
            "name": "Data Packaging and Exfiltration",
            "slug": "exfiltration-and-collection",
            "tactic": "exfiltration",
            "techniques": [
              "T1560.001",
              "T1048",
              "T1567",
              "T1567.002",
              "T1041"
            ],
            "observables": [
              "7-Zip",
              "WinRAR",
              "FileZilla",
              "RClone",
              "WinSCP",
              "b2.exe (Backblaze CLI)",
              "OneDrive"
            ]
          },
          {
            "name": "Ransomware Encryption and Recovery Inhibition",
            "slug": "impact-and-encryption",
            "tactic": "impact",
            "techniques": [
              "T1486",
              "T1490",
              "T1090.003"
            ],
            "observables": [
              "Files appended with .SafePay",
              "Halting Volume Shadow Copy Service",
              "Resetting NAS to factory settings",
              "Ransom note on desktop",
              "TOR .onion website link in note"
            ]
          }
        ],
        "summary": "SafePay ransomware actors gain initial access through VPN vulnerabilities, brute-force, or phishing, subsequently establishing persistence via account creation and privilege manipulation. They move laterally using LOLBins and RMM tools like ScreenConnect and AnyDesk, before exfiltrating data via cloud-sync utilities and deploying ransomware that encrypts files with a .SafePay extension and disables recovery mechanisms."
      },
      "severity": "high",
      "rationale": "Start the hunt by examining workstations with internet-facing RMM tools installed, then widen the scope if rare sign-ins to file servers are detected from those hosts.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "SafePay actors have established a foothold and are using repurposed administrative tools, credential dumpers, and anomalous RDP or SMB sessions to move laterally toward file shares.",
      "parameters": {
        "rmm_tools": {
          "from": {
            "ref": "AA26-293A",
            "kind": "article",
            "observed": "2026-10-20"
          },
          "type": "list[string]",
          "default": [
            "anydesk",
            "teamviewer",
            "screenconnect",
            "connectwise"
          ],
          "description": "RMM package or vendor names mentioned in SafePay reporting."
        },
        "recon_tools": {
          "from": {
            "ref": "AA26-293A",
            "kind": "article",
            "observed": "2026-10-20"
          },
          "type": "list[string]",
          "default": [
            "mimikatz.exe",
            "sharpshares.exe",
            "netexec.exe",
            "nxc.exe",
            "psexec.exe",
            "paexec.exe",
            "fodhelper.exe",
            "computerdefaults.exe"
          ],
          "description": "Filenames for discovery, credential dumping, and UAC bypass used by SafePay."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional list of hosts to narrow the search; leave empty for the whole estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a",
          "name": "CISA AA26-293A \u2014 #StopRansomware: SafePay Ransomware"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-endpoint-visibility",
          "risk": "A host without an agent allows an actor to run NetExec or Mimikatz invisibly at the host level; lateral movement would only be visible at the authentication source.",
          "stage": "discovery-and-credential-dumping",
          "question": "Are there internal servers performing network discovery that are not reporting process activity?",
          "requires": "Endpoint agent coverage on all internal servers"
        },
        {
          "id": "no-script-block-logging",
          "risk": "SafePay uses ShareFinder.ps1 for AD enumeration. If the actor loads the script content directly into memory, hb_process_activity may only see the powershell.exe launch, not the specific recon commands.",
          "stage": "discovery-and-credential-dumping",
          "question": "Was the ShareFinder.ps1 function run in-memory without a script file?",
          "requires": "PowerShell Script Block Logging (Event ID 4104)"
        }
      ]
    },
    "name": "SafePay: Internal Enumeration and Lateral Movement",
    "description": "SafePay actors rely on legitimate tools (AnyDesk, TeamViewer) for persistence and open-source scripts (ShareFinder, NetExec) for network discovery. This hunt identifies the presence of these RMM tools, detects the execution of common enumeration binaries at elevated integrity, and baselines internal authentication to find rare lateral movement paths. An agent weighs the findings to determine if an actor is actively traversing the estate."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "stopransomware-safepay-ransomware",
          "index": 2,
          "title": "#StopRansomware: SafePay Ransomware",
          "total": 3
        },
        "coverage": [
          {
            "stage": "discovery-and-credential-dumping",
            "steps": [
              "recon-tool-execution"
            ],
            "status": "covered"
          },
          {
            "stage": "lateral-movement-and-rmm-abuse",
            "steps": [
              "rmm-inventory",
              "lateral-auth-baseline"
            ],
            "status": "covered"
          },
          {
            "stage": "privilege-escalation-uac-bypass",
            "steps": [
              "recon-tool-execution"
            ],
            "reason": "The query includes common UAC bypass binaries such as fodhelper.exe and computerdefaults.exe and filters for high-integrity execution.",
            "status": "covered"
          },
          {
            "stage": "initial-access-vpn-and-phishing",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "persistence-via-account-manipulation",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "defense-evasion-and-stealth",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "exfiltration-and-collection",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "impact-and-encryption",
            "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "SafePay actors have established a foothold and are using repurposed administrative tools, credential dumpers, and anomalous RDP or SMB sessions to move laterally toward file shares.",
        "blind_spots": [
          {
            "id": "limited-endpoint-visibility",
            "risk": "A host without an agent allows an actor to run NetExec or Mimikatz invisibly at the host level; lateral movement would only be visible at the authentication source.",
            "stage": "discovery-and-credential-dumping",
            "question": "Are there internal servers performing network discovery that are not reporting process activity?",
            "requires": "Endpoint agent coverage on all internal servers"
          },
          {
            "id": "no-script-block-logging",
            "risk": "SafePay uses ShareFinder.ps1 for AD enumeration. If the actor loads the script content directly into memory, hb_process_activity may only see the powershell.exe launch, not the specific recon commands.",
            "stage": "discovery-and-credential-dumping",
            "question": "Was the ShareFinder.ps1 function run in-memory without a script file?",
            "requires": "PowerShell Script Block Logging (Event ID 4104)"
          }
        ],
        "scoping_notes": "Start the hunt by examining workstations with internet-facing RMM tools installed, then widen the scope if rare sign-ins to file servers are detected from those hosts.",
        "beyond_detection": "A single detection rule for 'mimikatz.exe' is easily bypassed by renaming. This hunt correlates the rare presence of RMM tools (AnyDesk/TeamViewer) with the high-integrity execution of discovery binaries and anomalous authentication paths to find the actor even when tools are rotated."
      }
    },
    {
      "id": "rmm-inventory",
      "type": "query",
      "label": "Inventory of SafePay-associated RMM software",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{rmm_tools}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{rmm_tools}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)",
        "surface": "hb_software_inventory",
        "description": "Identify hosts where AnyDesk, TeamViewer or ScreenConnect are installed, establishing the initial search scope.",
        "expected_signal": "A list of hosts containing RMM tools. Silence means no such software was recorded in the latest snapshot."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Inventory of SafePay-associated RMM software",
        "reads": [
          "device_hostname",
          "package_name",
          "vendor_name"
        ],
        "source": "hb_software_inventory",
        "target": "endpoint",
        "content": "SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (instr(',' || '{{rmm_tools}}' || ',', ',' || LOWER(package_name) || ',') > 0 OR instr(',' || '{{rmm_tools}}' || ',', ',' || LOWER(vendor_name) || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts containing RMM tools. Silence means no such software was recorded in the latest snapshot.",
        "verified": "dry-run",
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "recon-tool-execution",
      "type": "query",
      "label": "SafePay discovery and bypass tool execution",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_original_file_name, process_cmd_line, integrity_level, time FROM hb_process_activity WHERE (instr(',' || '{{recon_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{recon_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%sharefinder%') AND integrity_level IN ('High', 'System') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Find the execution of binaries for share discovery and UAC bypass, filtering for high-integrity launches that indicate successful elevation.",
        "expected_signal": "Process events for SharpShares, Mimikatz, or PsExec running with high integrity. Silence confirms these specific binaries did not run at high integrity on enrolled hosts."
      },
      "parents": [
        {
          "id": "rmm-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "SafePay discovery and bypass tool execution",
        "reads": [
          "device_hostname",
          "process_name",
          "process_original_file_name",
          "process_cmd_line",
          "integrity_level"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_original_file_name, process_cmd_line, integrity_level, time FROM hb_process_activity WHERE (instr(',' || '{{recon_tools}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{recon_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%sharefinder%') AND integrity_level IN ('High', 'System') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "evidence_of_absence",
        "expected": "Process events for SharpShares, Mimikatz, or PsExec running with high integrity. Silence confirms these specific binaries did not run at high integrity on enrolled hosts.",
        "verified": "dry-run",
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "lateral-auth-baseline",
      "type": "query",
      "label": "Rare internal network sign-ins",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, device_hostname, logon_type, COUNT(*) AS logins, MIN(time) AS first_login FROM hb_auth_signin WHERE status = 'Success' AND logon_type_id IN (3, 10) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip, device_hostname HAVING logins < 15",
        "surface": "hb_auth_signin",
        "description": "Baseline internal sign-ins to identify rare lateral movement paths using RDP or SMB that differ from normal admin patterns.",
        "expected_signal": "A few hosts showing rare incoming sessions from internal source IPs. Silence indicates no new or low-volume lateral paths were observed."
      },
      "parents": [
        {
          "id": "rmm-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare internal network sign-ins",
        "reads": [
          "actor_user_name",
          "src_endpoint_ip",
          "device_hostname",
          "logon_type_id",
          "status"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, device_hostname, logon_type, COUNT(*) AS logins, MIN(time) AS first_login FROM hb_auth_signin WHERE status = 'Success' AND logon_type_id IN (3, 10) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip, device_hostname HAVING logins < 15",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A few hosts showing rare incoming sessions from internal source IPs. Silence indicates no new or low-volume lateral paths were observed.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "actor_user_name",
            "src_endpoint_ip"
          ],
          "rare_below": 5
        },
        "verified_at": "2026-10-21"
      }
    },
    {
      "id": "weigh-evidence",
      "type": "analytic",
      "label": "Weigh the intrusion evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "rmm-inventory",
          "recon-tool-execution",
          "lateral-auth-baseline"
        ],
        "objective": "Determine if the presence of AnyDesk/TeamViewer, the high-integrity execution of SharpShares or NetExec, and the rare internal sign-ins indicate an active SafePay intrusion.",
        "description": "Analyze the RMM inventory, the elevated tools, and the rare sign-ins together to distinguish authorized admin work from a SafePay actor.",
        "max_iterations": 4,
        "expected_signal": "A verdict per host citing the tool and the lateral session that confirms it.",
        "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing specific rows from the tool and auth queries."
      },
      "parents": [
        {
          "id": "recon-tool-execution",
          "kind": "merge"
        },
        {
          "id": "lateral-auth-baseline",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the weigh-evidence verdict is malicious for at least one host",
        "condition": "the weigh-evidence verdict is malicious for at least one host",
        "blind_spot": "limited-endpoint-visibility",
        "confidence": "high",
        "description": "Isolate the host if the agent determines the activity is malicious.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "weigh-evidence"
        }
      ]
    },
    {
      "id": "isolate-host",
      "type": "action",
      "label": "Isolate host",
      "config": {
        "target": "endpoint",
        "description": "Contain the threat to prevent further lateral spread or file share enumeration.",
        "instructions": "Isolate the hosts identified as malicious and terminate any active RDP or WinRM sessions for the involved users.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-investigation",
      "type": "task",
      "label": "Analyst investigation",
      "config": {
        "assignee": "analyst",
        "description": "Verify the agent's findings and pivot to file activity to check for data staging.",
        "instructions": "Review the cited process and sign-in logs. Check hb_file_activity for bulk access to sensitive shares from the compromised hosts during the time window."
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "default"
        },
        {
          "id": "route-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document whether the tools were authorized and promote the detection query if unauthorized use was confirmed.",
        "instructions": "Record the findings. If SharpShares or NetExec execution was confirmed as unauthorized, promote the recon-tool-execution query to a standing rule."
      },
      "parents": [
        {
          "id": "route-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-investigation"
        }
      ]
    }
  ]
}