{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Akira affiliates consistently use RDP for lateral movement and disable endpoint security to proceed with credential theft. Detecting these precursor steps allows for containment before encryption starts." }, "name": "Akira: Remote Access and Security Software Disruption", "type": "investigation", "labels": [ "hunt", "attack.t1021.001", "attack.t1003.001", "attack.t1562.001", "command and control", "credential access", "defense evasion", "exfiltration", "impact", "lateral movement" ], "series": { "slug": "up-a-creek-without-a-command-line-mapping-an-akira-ransomware-attack", "index": 1, "title": "Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack", "total": 2 }, "related": [ { "hunt": "akira-persistence-and-exfiltration", "reason": "This hunt covers initial access and blinding; the next hunt in the series focuses on GOST tunneling and RClone exfiltration.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A simple alert for Bitdefender stopping is too noisy for most environments. This hunt correlates the RDP source (who), the service disruption (what), and the rare binary execution (why) into a single analytical verdict.", "coverage": [ { "stage": "rdp-lateral-access", "steps": [ "rdp-scoping" ], "status": "covered" }, { "stage": "defense-evasion-service-stop", "steps": [ "bitdefender-disruption" ], "status": "covered" }, { "stage": "lsass-credential-dumping", "steps": [ "rare-perflogs-processes" ], "status": "covered" }, { "stage": "gost-tunneling-persistence", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "rclone-data-exfiltration", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "inhibit-recovery-shadow-copy-deletion", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "akira-data-encryption", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "RDP Lateral Access", "slug": "rdp-lateral-access", "tactic": "lateral-movement", "techniques": [ "T1021.001" ], "observables": [ "Workstation name C1IFRYXI", "RDP connection from non-customer workstation" ] }, { "name": "Bitdefender Service Disablement", "slug": "defense-evasion-service-stop", "tactic": "defense-evasion", "observables": [ "Bitdefender Endpoint Update Service stopped", "Bitdefender Endpoint Integration Service stopped", "Bitdefender Endpoint Protected Service stopped", "Bitdefender Endpoint Security Service stopped" ] }, { "name": "LSASS Credential Dumping", "slug": "lsass-credential-dumping", "tactic": "credential-access", "techniques": [ "T1003.001" ], "observables": [ "procdump.exe", "C:\\PerfLogs\\procdump.exe", "lsass.exe dump" ] }, { "name": "GOST Tunneling Persistence", "slug": "gost-tunneling-persistence", "tactic": "command-and-control", "techniques": [ "T1572", "T1041" ], "observables": [ "C:\\PerfLogs\\Temp\\svchost.exe", "C:\\PerfLogs\\Temp\\config.dll", "d00833318a04caa019c6f95dcb3598ad947d405010bfb2f3cbd04530a00bc3a4", "64.227.4.134" ] }, { "name": "RClone Data Exfiltration", "slug": "rclone-data-exfiltration", "tactic": "exfiltration", "techniques": [ "T1567.002" ], "observables": [ "rclone.exe", "C:\\PerfLogs\\rclone.exe" ] }, { "name": "Recovery Inhibition via Shadow Copy Deletion", "slug": "inhibit-recovery-shadow-copy-deletion", "tactic": "impact", "techniques": [ "T1490", "T1047", "T1059.001" ], "observables": [ "powershell.exe -Command Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" ] }, { "name": "Akira Data Encryption", "slug": "akira-data-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "win.exe", "1f1bb322591b6d27fd2946e373d7d2efc2f4e1e66818846060d391600b600fba", "Akira log files", "Shellbags access to Shares folder" ] } ], "summary": "Akira ransomware affiliates gained access via RDP and disabled Bitdefender security services before using Procdump to harvest credentials. The attackers established persistence using the GOST tunnel tool and exfiltrated data via RClone before executing the Akira ransomware, which deleted volume shadow copies and encrypted files." }, "severity": "high", "rationale": "Begin the hunt on domain controllers and servers with public-facing services. Use the attacker workstation name 'C1IFRYXI' as a high-fidelity starting point.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has gained lateral access via RDP and is disabling security software to perform credential dumping from staging directories like PerfLogs.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hosts to narrow the investigation based on scoping results." }, "lookback_days": { "from": { "ref": "hunt-standard-lookback", "kind": "manual", "observed": "2024-10-06" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "attacker_workstation": { "from": { "ref": "Huntress Akira Mapping", "kind": "article", "observed": "2024-10-06" }, "type": "string", "default": "C1IFRYXI", "description": "Workstation name associated with the threat actor in the Huntress report." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/mapping-akira-ransomware-attack", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/mapping-akira-ransomware-attack", "name": "Huntress \u2014 Mapping an Akira Ransomware Attack" } ], "blind_spots": [ { "id": "missing-service-telemetry", "risk": "Stopping a service via process termination or registry modification (Start=4) might not trigger the specific SCM event used in this hunt.", "stage": "defense-evasion-service-stop", "question": "whether services were disabled via registry or killed directly as a process", "requires": "hb_service_activity with event_code 7036" }, { "id": "ephemeral-staging-paths", "risk": "Filtering on specific staging paths may miss tools run from deep user profile directories if not caught by the prevalence check.", "stage": "lsass-credential-dumping", "question": "whether the attacker used a random, non-PerfLogs path for staging", "requires": "hb_process_activity process_path" } ] }, "name": "Akira: Remote Access and Security Software Disruption", "description": "This hunt identifies early-stage Akira ransomware activity by correlating inbound RDP connections with subsequent efforts to blind security tools. It specifically looks for the cessation of Bitdefender services and the execution of rare binaries from the PerfLogs directory, a known staging area for this threat actor.\n\nBy examining authentication, service activity, and process telemetry, the hunt builds a timeline of compromise from initial lateral entry to the dumping of LSASS memory. An agent evaluates the combined evidence to distinguish between administrative maintenance and a coordinated ransomware precursor." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "up-a-creek-without-a-command-line-mapping-an-akira-ransomware-attack", "index": 1, "title": "Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack", "total": 2 }, "coverage": [ { "stage": "rdp-lateral-access", "steps": [ "rdp-scoping" ], "status": "covered" }, { "stage": "defense-evasion-service-stop", "steps": [ "bitdefender-disruption" ], "status": "covered" }, { "stage": "lsass-credential-dumping", "steps": [ "rare-perflogs-processes" ], "status": "covered" }, { "stage": "gost-tunneling-persistence", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "rclone-data-exfiltration", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "inhibit-recovery-shadow-copy-deletion", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" }, { "stage": "akira-data-encryption", "reason": "Belongs to another part of the 'Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack' series.", "status": "out_of_scope" } ], "rationale": "An adversary has gained lateral access via RDP and is disabling security software to perform credential dumping from staging directories like PerfLogs.", "blind_spots": [ { "id": "missing-service-telemetry", "risk": "Stopping a service via process termination or registry modification (Start=4) might not trigger the specific SCM event used in this hunt.", "stage": "defense-evasion-service-stop", "question": "whether services were disabled via registry or killed directly as a process", "requires": "hb_service_activity with event_code 7036" }, { "id": "ephemeral-staging-paths", "risk": "Filtering on specific staging paths may miss tools run from deep user profile directories if not caught by the prevalence check.", "stage": "lsass-credential-dumping", "question": "whether the attacker used a random, non-PerfLogs path for staging", "requires": "hb_process_activity process_path" } ], "scoping_notes": "Begin the hunt on domain controllers and servers with public-facing services. Use the attacker workstation name 'C1IFRYXI' as a high-fidelity starting point.", "beyond_detection": "A simple alert for Bitdefender stopping is too noisy for most environments. This hunt correlates the RDP source (who), the service disruption (what), and the rare binary execution (why) into a single analytical verdict." } }, { "id": "rdp-scoping", "type": "query", "label": "Inbound RDP Scoping", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT device_hostname, src_endpoint_hostname, actor_user_name, time FROM hb_auth_signin WHERE (LOWER(src_endpoint_hostname) = LOWER('{{attacker_workstation}}') OR (logon_type_id = 10 AND src_endpoint_hostname != '')) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Identify hosts targeted by RDP sessions from the reported attacker workstation or other external sources.", "expected_signal": "Hosts receiving RDP connections from the specific workstation name C1IFRYXI or high-volume remote interactive logins." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Inbound RDP Scoping", "reads": [ "device_hostname", "src_endpoint_hostname", "actor_user_name", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT device_hostname, src_endpoint_hostname, actor_user_name, time FROM hb_auth_signin WHERE (LOWER(src_endpoint_hostname) = LOWER('{{attacker_workstation}}') OR (logon_type_id = 10 AND src_endpoint_hostname != '')) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Hosts receiving RDP connections from the specific workstation name C1IFRYXI or high-volume remote interactive logins.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "rare-perflogs-processes", "type": "query", "label": "Rare Processes in PerfLogs", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS exec_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\perflogs\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING hosts <= 3 ORDER BY hosts ASC", "surface": "hb_process_activity", "description": "Find rare executables running from PerfLogs or Temp directories, which are used by Akira for staging tools like ProcDump.", "expected_signal": "A binary like procdump.exe or svchost.exe (masqueraded) running from C:\\PerfLogs on a small number of hosts." }, "parents": [ { "id": "rdp-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Processes in PerfLogs", "reads": [ "process_path", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS exec_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\\\perflogs\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING hosts <= 3 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A binary like procdump.exe or svchost.exe (masqueraded) running from C:\\PerfLogs on a small number of hosts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "path" ], "rare_below": 3 }, "verified_at": "2026-10-08" } }, { "id": "bitdefender-disruption", "type": "query", "label": "Bitdefender Service Disruption", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE (LOWER(service_name) LIKE '%bitdefender%') AND (LOWER(service_state) LIKE '%stop%' OR LOWER(service_state) LIKE '%disable%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_service_activity", "description": "Identify security service disablement following RDP access.", "expected_signal": "Multiple Bitdefender services being stopped on a host shortly after an inbound RDP session." }, "parents": [ { "id": "rdp-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Bitdefender Service Disruption", "reads": [ "device_hostname", "service_name", "service_state", "time" ], "source": "hb_service_activity", "target": "endpoint", "content": "SELECT device_hostname, service_name, service_state, time FROM hb_service_activity WHERE (LOWER(service_name) LIKE '%bitdefender%') AND (LOWER(service_state) LIKE '%stop%' OR LOWER(service_state) LIKE '%disable%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Multiple Bitdefender services being stopped on a host shortly after an inbound RDP session.", "verified": "dry-run", "verified_at": "2026-10-08" } }, { "id": "triage-compromise", "type": "analytic", "label": "Triage Compromise Indicators", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "rdp-scoping", "rare-perflogs-processes", "bitdefender-disruption" ], "objective": "Determine if the evidence supports an active Akira intrusion where an RDP session was followed by the stopping of security services and the execution of staging tools in PerfLogs.", "description": "Analyze the relationship between the RDP sessions, service stops, and rare process executions.", "max_iterations": 3, "expected_signal": "A host-by-host verdict on whether the observed pattern matches an Akira-style intrusion.", "success_criteria": "A verdict of malicious | suspicious | benign per host, citing the RDP source, the specific services stopped, and the path of the rare binary." }, "parents": [ { "id": "rare-perflogs-processes", "kind": "merge" }, { "id": "bitdefender-disruption", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host involving both service stops and rare binary execution", "condition": "the triage verdict is malicious for at least one host involving both service stops and rare binary execution", "blind_spot": "missing-service-telemetry", "confidence": "high", "description": "Direct the hunt based on the triage results.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-compromise" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate Host", "config": { "target": "endpoint", "description": "Contain the threat and prevent ransomware deployment.", "instructions": "Isolate the host immediately. Do not reboot. Collect the PerfLogs directory and LSASS memory dump if found.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst Verification", "config": { "assignee": "analyst", "description": "Review findings and check for follow-on activity like GOST or RClone.", "instructions": "Review the agent verdict. Check hb_process_activity for rclone.exe or GOST-related configurations in C:\\PerfLogs\\Temp." }, "parents": [ { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt Close-out", "config": { "assignee": "analyst", "description": "Document the outcome and any required tuning.", "instructions": "If no activity was found, record the hosts and time window. If legitimate maintenance caused a service stop, tune the detection candidate rule." }, "parents": [ { "id": "route-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }