SafePay ransomware .SafePay file encryption with ransom note and self-deletion
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Microsoft Sentinel (KQL)
