Detecting Akira: Documented TTPs and Behavioural Artifacts

Akira, active since 2023, targets both Windows hosts and Linux and ESXi servers. Public advisories describe entry through VPN and remote-access services, frequently where multi-factor authentication is missing or credentials have been stolen, followed by remote administration tooling, credential theft, network scanning and exfiltration. Much of that is ordinary software used for hostile purposes, so context and sequence matter more than any one command.

Signals at a Glance

Entry, Tools and Exfiltration

Public reporting, including CISA’s #StopRansomware advisory on Akira, links intrusions to VPN products where known vulnerabilities such as CVE-2023-20269 in Cisco ASA and FTD software, or missing MFA, let affiliates in. After entry the reporting describes domain account creation, credential extraction, scanning with commodity network tools, remote administration software and exfiltration with archivers and transfer clients. The Sigma rule below flags the shadow copy method that advisory describes, and generalises it:

title: PowerShell Shadow Copy Removal As Seen In Ransomware
logsource:
  product: windows
  category: process_creation
detection:
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'Win32_Shadowcopy'
      - 'Remove-WmiObject'
  selection_cim:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'Win32_Shadowcopy'
      - 'Remove-CimInstance'
  condition: 1 of them
level: high
# tune/validate: allowlist your backup tooling; pair with remote tool and exfil signals.

Because affiliates rely on dual-use software, detect the unsanctioned deployment rather than the tool. This hunt finds remote-management software appearing on servers outside your approved list, a common precursor stage:

// KQL - remote management tools installed or run outside the approved set
let approved = dynamic(["yourapprovedtool.exe"]);   // replace with your sanctioned tools
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("anydesk.exe", "teamviewer.exe", "screenconnect.clientservice.exe", "atera.exe", "rustdesk.exe")
| where FileName !in~ (approved)
| summarize firstSeen=min(Timestamp), hosts=dcount(DeviceName), sample=make_set(DeviceName, 5)
          by FileName, AccountName
| order by firstSeen desc
// tune/validate: extend the tool list to your threat model and drop sanctioned tools.

Encryptor and Platform Coverage

• Akira encrypted files are commonly reported with a distinctive appended extension and a readme-style note in affected directories. Use that for scoping after detection rather than as a primary alert.
• A Linux and ESXi encryptor exists, so cover hypervisors with the logging and shell-command detections on the ESXi page, and tie them to VPN logons from the same account.
• Later reporting describes a rewritten encryptor in a different language, which is another reason to key on file-activity behaviour and not on code or hashes.
• Close the entry points: require MFA on every VPN and remote-access path, patch perimeter appliances, and alert on logons from hosting-provider address ranges.