Akira Ransomware Encrypts in Safe Mode to Evade EDR — Detection and Response Guide for the Latest Malware Roundup

---
title: Boot Configuration Modified to Enable Safe Mode - Potential Ransomware EDR Evasion
id: 3f8a2c41-9b7d-4e6f-a1c2-8d4e5f6a7b8c
status: experimental
description: Detects bcdedit or PowerShell modifying boot configuration to force Safe Mode boot, a technique used by Akira ransomware to encrypt hosts while EDR is unloaded.
references:
  - https://securityaffairs.com/197743/security/security-affairs-malware-newsletter-round-111.html
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.impact
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\bcdedit.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'safeboot'
      - 'safebootalternateshell'
  condition: all of selection_*
falsepositives:
  - Legitimate break-fix or malware-removal maintenance windows (rare; should be change-controlled)
level: critical
---
title: Forced Immediate Reboot Following Admin Logon
id: 6b1d9e02-4c3a-4f58-b7d1-2e3f4a5b6c7d
status: experimental
description: Detects shutdown/restart commands with forced or zero-delay flags, which ransomware operators chain immediately after setting Safe Mode boot.
references:
  - https://securityaffairs.com/197743/security/security-affairs-malware-newsletter-round-111.html
  - https://attack.mitre.org/techniques/T1529/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1529
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\shutdown.exe'
    CommandLine|contains:
      - '/r /f /t 0'
      - '/r /f /t 1'
      - '-r -f -t 0'
      - '/r /t 0'
  condition: selection
falsepositives:
  - Patch management and software deployment tooling (filter by known deployment service accounts)
level: high
---
title: Suspicious Ruby Gem Post-Install Execution on Windows
id: 9e4c7a15-2d8b-4f61-a3c9-5b6d7e8f9a0b
status: experimental
description: Detects Ruby gem installation spawning scripting or download-capable child processes, consistent with malicious RubyGems packages delivering Windows infostealers (StubMaker campaign).
references:
  - https://securityaffairs.com/197743/security/security-affairs-malware-newsletter-round-111.html
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ruby.exe'
      - '\gem.exe'
      - '\gem.bat'
      - '\bundle.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: all of selection_*
falsepositives:
  - Native-extension gems invoking compilers or build scripts (filter on CI build accounts/hosts)
level: high

// Hunt: Safe Mode boot tampering + forced reboot chains (Akira EDR evasion)
// Windows endpoints/servers via Defender for Endpoint
let window = 7d;
DeviceProcessEvents
| where TimeGenerated > ago(window)
| where FileName =~ "bcdedit.exe"
   or (FileName in~ ("powershell.exe","pwsh.exe") and ProcessCommandLine has "safeboot")
| extend Suspicious = ProcessCommandLine has "safeboot"
| where Suspicious
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where FileName =~ "shutdown.exe" and ProcessCommandLine has_any ("/r", "-r")
    | project DeviceName, RebootTime=TimeGenerated, RebootCmd=ProcessCommandLine, InitiatingProcessAccountName
  ) on DeviceName
| where RebootTime between (TimeGenerated .. TimeGenerated + 30m)
| project BootTamperTime=TimeGenerated, DeviceName, BcdEditCmd=ProcessCommandLine,
          AccountName, RebootTime, RebootCmd, InitiatingProcessAccountName, ReportId
| order by BootTamperTime desc;
// Hunt: Linux botnet artifacts via Syslog/CEF ingestion (Evooo1Bot-style)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("cron","crond","systemd")
   and SyslogMessage has_any ("/tmp/", "/dev/shm/", "wget http", "curl http", "chmod +x")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

-- Hunt: SafeBoot configuration artifacts + recent bcdedit execution traces
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)safeboot'
   OR Exe =~ '(?i)bcdedit\.exe$'

-- Check registry SafeBoot service whitelist for unexpected additions
-- (ransomware sometimes registers the encryptor to survive Safe Mode)
SELECT FullPath, Name, Data
FROM glob(globs='HKEY_LOCAL_MACHINE\\SYSTEM\\*ControlSet*\\Control\\SafeBoot\\**',
          accessor='registry')

# Akira Safe Mode EDR-evasion audit & hardening script
# Run elevated on Windows servers/workstations; safe to deploy via GPO/SCCM

# 1. Detect: current boot entries configured for Safe Mode
$bcdOut = bcdedit /enum all 2>&1 | Out-String
if ($bcdOut -match 'safeboot') {
    Write-Warning "SAFE MODE BOOT CONFIGURED — investigate immediately:"
    $bcdOut | Select-String -Pattern 'safeboot' -Context 4,2
} else {
    Write-Host "[OK] No safeboot flags present in BCD."
}

# 2. Detect: recent bcdedit/shutdown executions in event logs (last 7 days)
$since = (Get-Date).AddDays(-7)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$since} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'bcdedit' -or ($_.Message -match 'shutdown.exe' -and $_.Message -match '/r') } |
  Select-Object TimeCreated, Message | Format-List

# 3. Harden: ensure your EDR service is registered to load in Safe Mode
#    (verify with your vendor; example check for Defender for Endpoint sense service)
$safeBootKeys = 'HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot\Network',
                'HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal'
foreach ($k in $safeBootKeys) {
    if (Test-Path "$k\sense") { Write-Host "[OK] MDE sense service present under $k" }
    else { Write-Warning "EDR service NOT whitelisted under $k — confirm vendor Safe Mode support" }
}

# 4. Remediate: strip safeboot flag from the current entry if found unexpectedly
#    (only after forensic triage — host may be mid-attack)
# bcdedit /deletevalue {current} safeboot

# 5. Alert forward: create a scheduled task that pages the SOC on bcdedit safeboot changes
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-Command "Write-EventLog -LogName Application -Source BCDWatch -EventId 9001 -Message ''safeboot flag set on $env:COMPUTERNAME''"'
Register-ScheduledTask -TaskName 'BCD-SafeBoot-Watch' -Action $action -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date)) -ErrorAction SilentlyContinue | Out-Null
Write-Host "Review complete. Investigate any [WARN] output before remediating."