Akira Ransomware: Sub-One-Hour Encryption — Detection and Mitigation Guide

---
title: Akira Ransomware - VSS Deletion Pattern
id: 9e8c7f6a-1b3d-4c5e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects the deletion of Volume Shadow Copies, a common tactic in Akira attacks to prevent recovery immediately prior to encryption.
references:
  - https://halcyon.ai/blog/akira-ransomware-update
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  condition: 1 of selection_*
falsepositives:
  - System administrators manually managing disk space (rare in production environments)
level: critical
---
title: Akira Ransomware - Suspicious PowerShell Child Process
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects PowerShell spawning typical Akira post-exploitation tools or making network connections often associated with lateral movement scripts.
references:
  - https://halcyon.ai/blog/akira-ransomware-update
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\powershell.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  selection_suspicious_cli:
    CommandLine|contains:
      - 'Add-PSSnapin'
      - 'Invoke-Expression'
  condition: selection_parent and selection_child and selection_suspicious_cli
falsepositives:
  - Legitimate system administration scripts
level: high

// Hunt for rapid VSS deletion and execution of Akira-associated binaries
let TimeFrame = 1h;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
   or (ProcessCommandLine contains "akira_recover.txt") // Ransom note creation
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for VSS manipulation and suspicious process execution patterns
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username, 
  CreateTime
FROM pslist()
WHERE Name =~ "vssadmin" 
   AND CommandLine =~ "delete shadows"
   OR Name =~ "wmic" 
   AND CommandLine =~ "shadowcopy"

# Remediation script to check for Akira persistence and re-enable VSS if disabled
# Requires Administrator Privileges

Write-Host "[+] Checking for Akira Ransomware Indicators..." -ForegroundColor Cyan

# Check for common ransom note pattern
$noteLocations = @("C:\", "C:\Users\Public", "C:\Windows\Temp")
$indicatorsFound = $false

foreach ($loc in $noteLocations) {
    if (Test-Path "$loc\akira_recover.txt") {
        Write-Host "[!] CRITICAL: Ransom note found at $loc" -ForegroundColor Red
        $indicatorsFound = $true
    }
}

# Check VSS Service Status
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vssService.Status -ne "Running") {
    Write-Host "[!] WARNING: Volume Shadow Copy Service is not running." -ForegroundColor Yellow
    try {
        Start-Service -Name VSS -ErrorAction Stop
        Write-Host "[+] Attempted to start VSS service." -ForegroundColor Green
    } catch {
        Write-Host "[-] Failed to start VSS service. Manual intervention required." -ForegroundColor Red
    }
} else {
    Write-Host "[+] VSS Service is running." -ForegroundColor Green
}

if ($indicatorsFound) {
    Write-Host "[!] ACTION REQUIRED: Isolate this host immediately and initiate IR protocols." -ForegroundColor Red
} else {
    Write-Host "[+] No immediate Akira artifacts found on host." -ForegroundColor Green
}