Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Snatch – Reboot into Safe Mode Followed by Security Service Stop (Origin Case)

Snatch Defense Evasion Sentinel
MITRE ATT&CK
Service Stop
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
CISA AA23-263A (#StopRansomware: Snatch); ransomware.live group_tools dataset (snatch)
What This Detects
Snatch is the documented origin case of the reboot-into-Safe-Mode-then-encrypt technique later adopted by Medusa and others – correlates a Safe Mode reboot with a subsequent security-service stop via sc.exe.
Query
let safeMode = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("safeboot minimal","safeboot network")
| project DeviceName, SafeModeTime = Timestamp;
let svcStop = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "sc.exe" and ProcessCommandLine has_any ("stop","config")
| project DeviceName, StopTime = Timestamp, StopCmd = ProcessCommandLine;
safeMode
| join kind=inner svcStop on DeviceName
| where StopTime - SafeModeTime between (0min .. 2h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.