A detection engineering project covering the Akira ransomware intrusion lifecycle, from initial VPN access through encryption. Built for threat hunting practice and SOC workflow development.
Focus is on behavioral detection. Most Akira behaviors rely on LOLBins, dual-use utilities, and renamed binaries — hashes and IPs rotate between campaigns, the underlying behaviors don't.
- Malware development or live payload analysis
- IOC-only detection
- Generic ATT&CK summary
- A guide to Sigma or MITRE basics
- Windows intrusion lifecycle -— initial access through encryption
- ESXi and hypervisor attack paths
- Incidents from 2023 through early 2026
- Based on CISA AA24-109A (Nov 2025), Unit 42, Arctic Wolf Labs, Sophos MDR, IBM X-Force
Detection logic starts from confirmed incident behaviors, not generic ATT&CK technique descriptions. detection/rule_logic.md documents what to detect, why it matters, and what telemetry supports it. Sigma rules are built from that logic, not written independently.
Most individual events here look benign without context. The value comes from how they appear together within the same session window — velocity, sequencing, and correlation are what make a finding.
Pre-encryption is the main detection window. Credentials are stolen before lateral movement. Data is exfiltrated before encryption. The ransom note is already too late.
Repository Structure
akira-threat-hunting/
├── analysis/ # Attack timeline and hunting notes
├── artifacts/ # Observable evidence and command patterns by phase
├── detection/ # Rule logic, detection coverage matrix, and 13 Sigma rules
├── findings/ # Executive summary
├── hunting/ # Hunt hypotheses and playbook
└── intel/ # TTP table, actor profile, IOC summary, ATT&CK navigator layer
13 behavioral rules across 7 ATT&CK tactic folders. Written to Sigma 2.x syntax, with backend conversion in mind for Splunk, Elastic, and Microsoft Sentinel — field mapping adjustments may be needed depending on normalization schema.
Priority rules:
- Shadow copy deletion via vssadmin/WMIC and PowerShell WMI (separate rules — both needed for full coverage)
- LSASS access from rundll32 via comsvcs.dll
- Ngrok DNS resolution from internal hosts
- WmiPrvSE spawning cmd or PowerShell
- Account creation followed immediately by admin group membership
- Kernel driver loaded from a user-writable path
Full telemetry requirements and tuning notes are in detection/sigma_rules/README.md.
Rules assume the following is configured and forwarding to a SIEM:
- Sysmon — EID 1 (ProcessCreate), EID 6 (DriverLoad), EID 10 (ProcessAccess), EID 22 (DNS query)
- Windows Security log — EID 4624, 4720, 4732, 4698, 4769, 1102
- Windows System log — EID 104
- PowerShell Script Block Logging — EID 4104
- Centralized collection with consistent timestamps
Two gaps worth calling out: without Sysmon ProcessAccess logging, the LSASS rules won't fire. Without Script Block Logging, COM-based shadow copy deletion — the method IBM X-Force confirmed Akira's encryptor uses — is invisible to all process-creation detections.
Complete:
- Threat intelligence analysis and MITRE ATT&CK mapping
- Detection logic documentation
- Sigma rule development (13 rules)
Planned (Phase 2):
- Atomic Red Team emulation and validation
- SIEM telemetry testing and screenshots
- Detection coverage matrix finalization
IOC hashes from CISA AA24-109A cover June 2023 through August 2025 — validate against current threat feeds before use.
CISA AA24-109A (Nov 2025) · Unit 42 Howling Scorpius (Nov 2025) · Arctic Wolf Labs (Sep 2025) · IBM X-Force · Sophos MDR · Picus Security (Feb 2026) · AttackIQ (Nov 2025)
Full reference list in references.md.