Potential Snatch Ransomware Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 29, 2025•0•30

This rule detects specific command-line patterns associated with Snatch ransomware activity. Specifically, it looks for commands that immediately reboot the system into safe mode ('shutdown /r /f /t 00') and commands that stop the 'SuperBackupMan' service ('net stop SuperBackupMan'). These actions are characteristic of Snatch ransomware's evasion and impact tactics, where it reboots into safe mode to bypass security software and stops backup-related services to facilitate encryption.