SafePay Ransomware: CISA/FBI/USSS Joint Advisory — Detection, Hardening, and Response Guide for Defenders

---
title: Shadow Copy Deletion via vssadmin wmic or PowerShell
description: Detects deletion of Volume Shadow Copies, a hallmark ransomware defense-evasion step observed in SafePay intrusions prior to encryption.
references:
  - https://www.cisa.gov/stopransomware
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Delete-WmiObject'
      - 'Get-WmiObject Win32_Shadowcopy'
  condition: selection_img and selection_cli
falsepositives:
  - Backup administrators performing legitimate shadow copy maintenance
  - Some backup software performs shadow storage resizing
tags:
  - attack.impact
  - attack.t1490
level: high
---
title: Boot Recovery Tampering via bcdedit
description: Detects bcdedit commands disabling Windows recovery mode or ignoring boot failures, consistent with SafePay ransomware pre-encryption system preparation.
references:
  - https://www.cisa.gov/stopransomware
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
falsepositives:
  - Rare; some OEM imaging and kiosk configurations
tags:
  - attack.impact
  - attack.t1490
level: high
---
title: SafePay Ransom Note or Encrypted File Artifact Creation
description: Detects creation of SafePay ransom notes (readme_safepay.txt) or files with the .safepay encrypted extension being written to disk.
references:
  - https://www.cisa.gov/stopransomware
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection_note:
    TargetFilename|endswith: '\readme_safepay.txt'
  selection_ext:
    TargetFilename|endswith: '.safepay'
  condition: 1 of selection_*
falsepositives:
  - Threat research or sandbox detonation environments
tags:
  - attack.impact
  - attack.t1486
level: critical

// Hunt 1: Pre-encryption tampering (shadow copy deletion / recovery disable)
let TamperEvents = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
| project TamperTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
// Hunt 2: Mass rename to .safepay extension (Defender file events)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where ActionType == "FileRenamed" and FileName endswith ".safepay"
| summarize RenameCount = count(), FirstRename = min(TimeGenerated), LastRename = max(TimeGenerated), SampleFiles = make_set(FileName, 10) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where RenameCount > 50
| join kind=leftouter TamperEvents on DeviceName
| project DeviceName, RenameCount, FirstRename, LastRename, InitiatingProcessFileName, InitiatingProcessAccountName, TamperTime, ProcessCommandLine, SampleFiles
| sort by RenameCount desc

// Hunt 3: Ransom note drops anywhere in the estate
union DeviceFileEvents, (CommonSecurityLog | where isnotempty(FileName))
| where TimeGenerated > ago(7d)
| where tostring(column_ifexists("FileName", "")) has "readme_safepay"
   or tostring(column_ifexists("NewFileName", "")) has "readme_safepay"
| project TimeGenerated, DeviceName = column_ifexists("DeviceName", Computer), ActionType = column_ifexists("ActionType", Activity), FileName, InitiatingProcessFileName, FolderPath

-- SafePay artifact sweep: ransom notes, encrypted files, and tampering processes
SELECT * FROM foreach(row={
    SELECT 'RANSOM_NOTE' AS ArtifactType, FullPath AS Evidence, '' AS Detail
    FROM glob(globs='C:/Users/*/Desktop/**/readme_safepay.txt')
}, query={
    SELECT ArtifactType, Evidence, Detail FROM source()
})
UNION ALL
SELECT 'TAMPER_PROCESS' AS ArtifactType,
       Exe AS Evidence,
       format(format='%v | PID=%v | User=%v', args=[CommandLine, Pid, Username]) AS Detail
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures)'
UNION ALL
SELECT 'PERSISTENCE_CHECK' AS ArtifactType,
       Name AS Evidence,
       format(format='%v -> %v', args=[Exe, CommandLine]) AS Detail
FROM pslist()
WHERE Exe =~ '(?i)(users\\public|appdata\\local\\temp|programdata)'
   AND CommandLine =~ '(?i)(\\.safepay|readme_safepay)'

# Security Arsenal - SafePay Ransomware Resilience Audit (run elevated)
# 1. Verify Volume Shadow Copies exist and vssadmin service is operational
Write-Host '=== Shadow Copy Status ===' -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) { $shadows | Select-Object DeviceObject, InstallDate | Format-Table } else { Write-Warning 'NO shadow copies found - recovery capability degraded. Create a baseline: vssadmin create shadow /for=C:' }

# 2. Check RDP exposure - SafePay initial access vector
Write-Host '=== RDP Configuration ===' -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
if ($rdp.fDenyTSConnections -eq 0) { Write-Warning 'RDP ENABLED. Confirm it is NOT internet-exposed and is behind VPN + MFA. To disable: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -Value 1' } else { Write-Host 'RDP disabled - good.' }
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
if ($nla.UserAuthentication -ne 1) { Write-Warning 'NLA not enforced on RDP. Set UserAuthentication=1' }

# 3. Disable SMBv1 (lateral movement hardening)
Write-Host '=== SMBv1 Status ===' -ForegroundColor Cyan
$smb1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($smb1.State -eq 'Enabled') { Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart; Write-Host 'SMBv1 disabled (reboot required).' } else { Write-Host 'SMBv1 not enabled - good.' }

# 4. Audit recent vssadmin/bcdedit execution via process creation (4688) if enabled
Write-Host '=== Recent Tampering Events (last 7 days, 4688 required) ===' -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'delete shadows|shadowcopy delete|recoveryenabled no|readme_safepay|\.safepay' } |
  Select-Object TimeCreated, @{N='Command';E={($_.Message -split "`n") -match 'Process Command Line'}} | Format-List

# 5. Verify Windows Defender Tamper Protection state
Write-Host '=== Defender Tamper Protection ===' -ForegroundColor Cyan
$mp = Get-MpComputerStatus
if (-not $mp.IsTamperProtected) { Write-Warning 'Tamper Protection OFF - ransomware can disable Defender. Enable in MDE/Intune portal.' } else { Write-Host 'Tamper Protection ON.' }