Pulp-style illustration of a lighthouse beam catching a cargo ship at night under a red lamp

Hunt: SafePay’s recovery sabotage and exfiltration tools

SafePay, like most ransomware crews, removes your way back before it locks the door, and it uses ordinary tools to carry the data out first. Two Sigma rules for Windows process telemetry, both untested drafts.

What the advisory tells us

Joint advisory AA26-293A (opens in a new tab), released on 20 October 2026, says SafePay actors “halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts”. For collection and theft it names 7-Zip, WinRAR, FileZilla, WinSCP and RClone, sometimes OneDrive, and says the actors “executed commands via b2.exe to exfiltrate a victim’s data”, b2.exe being the Backblaze B2 command-line tool. NetExec appears in the tool table for enumeration. Our news piece covers the rest.

None of this is unique to SafePay. That is a feature for a hunt: the same rules catch a lot of other people’s bad days too.

Rule 1: shadow copies deleted or VSS stopped

The classic precursor. The rule looks for vssadmin deleting shadows or resizing shadow storage (resizing to almost nothing is the quieter way to delete), wmic shadowcopy delete, and net or sc stopping the VSS service.

title: Shadow Copy Deletion Or VSS Service Stop
id: 07dd4c6c-8dd9-4469-ad89-14ac582c580d
status: experimental
description: |
    Detects stopping of the VSS service, which the SafePay joint advisory (AA26-293A) describes, plus
    shadow copy deletion or shrinking, a common precursor the advisory does not specifically mention. Generic ransomware precursor, not
    SafePay-specific. UNTESTED DRAFT: not yet run against live or lab data.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
author: Cyber-Threat.net Hunt Lab
date: 2026-10-22
tags:
    - attack.impact
    - attack.t1490
logsource:
    product: windows
    category: process_creation
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_svc_img:
        Image|endswith:
            - '\net.exe'
            - '\net1.exe'
            - '\sc.exe'
    selection_svc_cmd:
        CommandLine|re: '(?i)\bstop\s+"?(vss|volume shadow copy)"?(\s|$)'
    condition: selection_vssadmin or selection_wmic or (selection_svc_img and selection_svc_cmd)
falsepositives:
    - Backup software or administrators managing shadow storage
level: high

Expect some noise from backup software and from administrators reclaiming disk space. A burst of these commands across several hosts within minutes is not housekeeping.

The NAS factory reset won’t show up here. It happens on the NAS, through its own admin interface. If your NAS can send its logs to a syslog server, log administrative logins and reset or format actions, and alert on any from an unexpected address. That is probably the most valuable thing in this piece, and it isn’t a Sigma rule.

Rule 2: exfiltration and enumeration tools

The second rule flags RClone running a copy, sync or move (or with an explicit config file), any execution of b2.exe, and NetExec under either of its executable names.

title: Rclone, Backblaze B2 CLI Or NetExec Execution
id: 22b58024-8840-4d7c-b452-4c40d50e672c
status: experimental
description: |
    Detects execution of tools the SafePay joint advisory (AA26-293A) lists for exfiltration and
    enumeration: RClone, the Backblaze B2 command-line tool (b2.exe) and NetExec (nxc.exe).
    UNTESTED DRAFT: not yet run against live or lab data.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
author: Cyber-Threat.net Hunt Lab
date: 2026-10-22
tags:
    - attack.exfiltration
    - attack.t1567.002
    - attack.t1048
    - attack.discovery
    - attack.t1135
logsource:
    product: windows
    category: process_creation
detection:
    selection_rclone_img:
        - Image|endswith: '\rclone.exe'
        - OriginalFileName: 'rclone.exe'
        - Description: 'Rsync for cloud storage'
    selection_rclone_cmd:
        CommandLine|contains:
            - ' copy '
            - ' sync '
            - ' move '
            - '--config'
    selection_b2:
        - Image|endswith: '\b2.exe'
        - OriginalFileName: 'b2.exe'
    selection_nxc:
        - Image|endswith:
            - '\nxc.exe'
            - '\netexec.exe'
        - CommandLine|contains:
            - 'nxc smb'
            - 'netexec smb'
    condition: (selection_rclone_img and selection_rclone_cmd) or selection_b2 or selection_nxc
falsepositives:
    - IT staff using rclone or the B2 CLI for sanctioned backups
    - Authorised penetration testing with NetExec
level: medium

Matching on OriginalFileName as well as the image path catches the crudest rename trick where the binary carries version information, since Sysmon reads the name from the PE header. The rule also matches rclone’s file description, “Rsync for cloud storage”. For broader rclone coverage, SigmaHQ maintains a PUA – Rclone Execution (opens in a new tab) rule. A recompiled or packed binary will still slip past. RClone in particular is used legitimately, so build an allow-list of the hosts and accounts that run it for real backups, rather than switching the rule off.

Getting the telemetry for free

  • Sysmon event ID 1 gives you process creation with full command lines and OriginalFileName. Use a maintained community configuration as a starting point.
  • Windows Security log event 4688 works too, if you enable command-line auditing in Group Policy. It has no OriginalFileName, so the rename coverage goes.
  • Wazuh ingests Sysmon events through its Windows agent and has its own rule language; convert the logic by hand or use a community converter.
  • Elastic, free tier: if you collect Sysmon with Elastic Agent’s Windows integration, convert with sigma convert -t eql -p ecs_windows. On standalone Winlogbeat data, remove the .caseless suffix from the field names first, because Winlogbeat’s template doesn’t map them. For Elastic Defend data, use the ECS pipeline in our Hunt Lab repository (opens in a new tab), and rename rule 2’s unmapped Description field to process.pe.description, because EQL rejects fields that don’t exist. EQL’s : comparison ignores case. Lucene and ES|QL output is case-sensitive on process.command_line, so it will miss VSSADMIN and friends unless you add case variants. Rule 1’s service-stop check won’t survive conversion: its EQL output leaves double quotes unescaped inside the regex, which EQL’s string syntax (opens in a new tab) doesn’t allow, so expect Elastic to reject the query. Elastic’s regex engine (opens in a new tab) also has no anchors, \b or (?i), and must match the whole command line, so drop that selection or rewrite it by hand before you run the rest.

Status and limits

Both rules pass sigma check and convert to Lucene without errors. Neither has been run against real or lab data. They are untested drafts, and we say so twice because it matters.

  • They are generic. A hit means “look now”, not “SafePay is here”.
  • Rule 1 misses PowerShell and WMI calls made through APIs rather than the command-line tools.
  • Rule 2 depends on file names and command lines, both of which an attacker controls.
  • The advisory lists IP addresses too, but several belong to Cloudflare, GitHub and Google, and the authors ask organisations to investigate before blocking. They make poor detection content.

What to do

  1. Deploy both rules where you collect Windows process telemetry, starting with file servers, backup servers and domain controllers.
  2. Send NAS admin logs somewhere the attacker can’t reset.
  3. Inventory RClone, B2, AnyDesk, TeamViewer and ScreenConnect use, and decide which instances you actually sanctioned.
  4. Test that you can restore from an offline copy. A backup you’ve never restored from is a hope, not a control.

More hunts are collected in Hunt Lab.

Correction, 27 October 2026: we corrected the Elastic advice. sigma-cli doesn’t accept the ecs_windows pipeline with ES|QL, and ES|QL’s LIKE is case-sensitive, so we now recommend EQL, and we’ve noted two checks in our rules that need adapting for Elastic.

Use with care. These queries, indicators and scripts are provided as-is, for defensive use on systems you own or are authorised to test. Test and tune them before you use them in production. Indicators age quickly, so check the date and source before you block on one. Nothing here authorises access to systems that aren’t yours. Doing so may be an offence under the Computer Misuse Act 1990. Full terms.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)