Akira Ransomware Affiliate Sabotages Own Attack with Failed EDR Evasion — Detection and Hardening Guide for EDR Tampering

---
title: Security Product Service Termination via Command Line
description: Detects attempts to stop or delete security product services using sc.exe or net.exe, a hallmark of ransomware pre-encryption defense impairment as seen in Akira intrusions.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://www.infosecurity-magazine.com/news/akira-affiliate-crashes-ransomware/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
  selection_action:
    CommandLine|contains:
      - 'stop'
      - 'delete'
      - 'disable'
  selection_target:
    CommandLine|contains:
      - 'WinDefend'
      - 'Sense'
      - 'SentinelAgent'
      - 'CSFalconService'
      - 'HuntressAgent'
      - 'Sophos'
      - 'CarbonBlack'
      - 'CbDefense'
      - 'MsMpEng'
      - 'ElasticAgent'
      - 'cyserver'
  condition: selection_binary and selection_action and selection_target
falsepositives:
  - Legitimate EDR upgrades or scripted agent reinstalls by IT
  - Managed service provider maintenance windows
level: high
---
title: Windows Defender Tampering via Registry or PowerShell
description: Detects registry-based Defender disabling and Set-MpPreference abuse consistent with ransomware operator defense evasion before payload detonation.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://www.infosecurity-magazine.com/news/akira-affiliate-crashes-ransomware/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg:
    Image|endswith: '\reg.exe'
    CommandLine|contains:
      - 'Windows Defender'
      - 'DisableAntiSpyware'
      - 'DisableRealtimeMonitoring'
      - 'DisableBehaviorMonitoring'
      - 'DisableOnAccessProtection'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Set-MpPreference'
    CommandLine|contains:
      - '-DisableRealtimeMonitoring $true'
      - '-DisableBehaviorMonitoring $true'
      - '-DisableIOAVProtection $true'
      - 'Add-MpPreference -ExclusionPath'
      - '-ExclusionPath C:'
      - '-ExclusionProcess'
  condition: 1 of selection_*
falsepositives:
  - Rare: documented IT exclusion changes — alert and verify against change tickets
level: high
---
title: Suspicious Kernel Driver Load — BYOVD EDR Killer Indicators
description: Detects loading of drivers from non-standard paths commonly abused in Bring Your Own Vulnerable Driver attacks used to terminate EDR from kernel mode, as attempted by the Akira affiliate.
references:
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1562/001/
  - https://www.infosecurity-magazine.com/news/akira-affiliate-crashes-ransomware/
author: Security Arsenal
date: 2026/02/10
status: experimental
logsource:
  category: driver_load
  product: windows
detection:
  selection_path:
    ImageLoaded|contains:
      - '\Users\Public\'
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
      - '\Windows\Temp\'
      - '\Perflogs\'
  filter_legit:
    Signed: 'true'
    SignatureStatus: 'valid'
  condition: selection_path and not filter_legit
falsepositives:
  - Some legitimate OEM utilities load drivers from ProgramData — baseline per environment
level: critical

// Hunt: Akira-style pre-encryption defense impairment
// Looks for security service tampering, Defender manipulation, and suspicious driver drops
// across a 7-day window, correlated to a single host for triage efficiency.
let Lookback = 7d;
let SecurityTargets = dynamic(["WinDefend","Sense","SentinelAgent","CSFalconService","HuntressAgent","MsMpEng","CbDefense","Sophos","cyserver"]);
let ServiceTamper =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName in~ ("sc.exe","net.exe","net1.exe","taskkill.exe","powershell.exe","pwsh.exe","reg.exe")
    | where ProcessCommandLine has_any (SecurityTargets)
       or ProcessCommandLine has_any ("DisableAntiSpyware","DisableRealtimeMonitoring","Set-MpPreference","ExclusionPath")
    | project ServiceTamperTime=Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName;
let DriverDrop =
    DeviceFileEvents
    | where Timestamp > ago(Lookback)
    | where FileName endswith ".sys"
    | where FolderPath has_any ("\\Users\\Public\\","\\AppData\\","\\Temp\\","\\ProgramData\\","\\Perflogs\\")
    | project DriverDropTime=Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
ServiceTamper
| join kind=fullouter DriverDrop on DeviceName
| extend EarliestActivity = min_of(ServiceTamperTime, DriverDropTime)
| summarize Activities = make_set(strcat(FileName, " :: ", ProcessCommandLine)),
            DroppedDrivers = make_set(FolderPath),
            FirstSeen = min(EarliestActivity),
            LastSeen = max(iff(isnull(DriverDropTime), ServiceTamperTime, DriverDropTime))
  by DeviceName, AccountName
| sort by FirstSeen asc;

-- Hunt: EDR tampering artifacts and suspicious driver staging on Windows endpoints
-- Targets: driver files in user-writable paths, deleted/stopped security services,
-- and Defender tamper registry keys. Deploy as a fleet-wide Velociraptor hunt.

-- Artifact 1: Driver files staged outside System32\drivers
LET drivers = SELECT FullPath AS DriverPath,
       Mtime AS Modified,
       Size
FROM glob(globs=[
  'C:/Users/Public/**/*.sys',
  'C:/Windows/Temp/**/*.sys',
  'C:/ProgramData/**/*.sys',
  'C:/Users/*/AppData/**/*.sys'
])
WHERE Modified > now() - 604800  -- last 7 days

SELECT DriverPath, Modified, Size FROM drivers

-- Artifact 2: Defender tamper registry keys
SELECT FullPath AS RegKey,
       Data.value AS RegValue,
       Mtime AS LastWrite
FROM glob(globs='HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows Defender/*',
          accessor='registry')
WHERE RegKey =~ 'DisableAntiSpyware|DisableRealtimeMonitoring'
   OR RegValue = 0x1

-- Artifact 3: Processes holding handles to known EDR-killer service names
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(sc (stop|delete)|net stop|taskkill).*(WinDefend|Sense|SentinelAgent|CSFalcon|Huntress|MsMpEng)'

# Akira Defense-Impairment Hardening & Verification Script
# Run elevated on Windows endpoints/servers. Verifies the controls that stop
# EDR-killer tradecraft: Tamper Protection, vulnerable driver blocklist,
# and real-time monitoring state.

Write-Host "=== [1/5] Defender Tamper Protection Status ===" -ForegroundColor Cyan
$mp = Get-MpComputerStatus
$tp = Get-MpPreference | Select-Object -ExpandProperty DisableRealtimeMonitoring
Write-Host ("Real-Time Monitoring Disabled : {0}" -f $tp)
Write-Host ("Tamper Protection Enabled     : {0}" -f $mp.IsTamperProtected)
if (-not $mp.IsTamperProtected) {
    Write-Warning "Tamper Protection is OFF. Enable it in the Microsoft Defender portal (Intune/Manual) — this is the single highest-value control against ransomware EDR evasion."
}

Write-Host "`n=== [2/5] Microsoft Vulnerable Driver Blocklist ===" -ForegroundColor Cyan
$vdb = Get-CimInstance -Namespace "root\Microsoft\Windows\Defender" -ClassName MSFT_MpPreference -ErrorAction SilentlyContinue
$hvci = (Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue).SecurityServicesRunning
Write-Host "HVCI / Memory Integrity state : $hvci"
Write-Host "Verify 'Microsoft Vulnerable Driver Blocklist' is enabled: Defender portal > ASR or Smart App Control settings. Blocklist requires HVCI or SACA on supported builds."

Write-Host "`n=== [3/5] Defender Exclusions Audit (ransomware operators abuse these) ===" -ForegroundColor Cyan
$pref = Get-MpPreference
if ($pref.ExclusionPath -or $pref.ExclusionProcess) {
    Write-Warning "Exclusions present — validate every entry against approved change records:"
    $pref.ExclusionPath   | ForEach-Object { Write-Host "  Path   : $_" }
    $pref.ExclusionProcess| ForEach-Object { Write-Host "  Process: $_" }
} else {
    Write-Host "No exclusions configured. Good."
}

Write-Host "`n=== [4/5] Security Service Integrity Check ===" -ForegroundColor Cyan
$services = @("WinDefend","Sense","WdNisSvc","HuntressAgent")
foreach ($svc in $services) {
    $s = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($s) {
        $color = if ($s.Status -eq 'Running' -and $s.StartType -ne 'Disabled') { 'Green' } else { 'Red' }
        Write-Host ("  {0,-15} Status: {1,-10} StartType: {2}" -f $svc, $s.Status, $s.StartType) -ForegroundColor $color
        if ($s.StartType -eq 'Disabled') { Write-Warning "$svc is DISABLED — treat as a potential tampering indicator." }
    }
}

Write-Host "`n=== [5/5] Suspicious .sys Files in User-Writable Paths (last 7 days) ===" -ForegroundColor Cyan
$paths = @("$env:PUBLIC","$env:TEMP","C:\ProgramData","C:\Windows\Temp")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -Filter *.sys -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
        ForEach-Object { Write-Warning ("Suspicious driver file: {0} (modified {1})" -f $_.FullName, $_.LastWriteTime) }
}
Write-Host "`nVerification complete. Escalate any RED/WARNING findings to IR." -ForegroundColor Cyan