Akira / REDBIKE Ransomware

Looks for: process execution whose SHA-256 equals one of five current joint-advisory artifacts. Accomplishes: supplies the highest-confidence Akira pivot in the pack, while keeping response conditional on contextual verification rather than hash-only prevention.

Trace: H01 · Decision Q01

// HUNT: Akira advisory hash execution
// HYPOTHESIS: H01
// USE: hunt
// MITRE: T1486
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — low-volume exact-hash retrospective
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; SHA256HashData, FileName, ImageFileName, CommandLine, aid, ComputerName, UserName, TargetProcessId, @timestamp
// FALSE POSITIVES: stale or incorrectly contextualized intelligence; no ordinary benign exact-hash match expected
// TUNING: Confirm source context and file provenance before containment; do not suppress exact matches solely by filename
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 2592000000)
| in(SHA256HashData, values=["cf3465d7e49b609defa1e2b6cfcc86ffa30c72246cb2744dbf50736c5f3d74d5","58afef43cec0ee7a2fbfd9cdd5b71f55f971672d5e523a400b82b98c752ca5b7","bfd5fc6cd3dea74738ac7025fa14ea844f400708df2293572796568f65bd6b61","8e12c8eb39cec9a414b56a36acbcc1a5b31dc96a38bc668138a00f94f7c26ea5","7266e2afb5c70788c018d684698b0940eded4cb863f2b33f4edd31b59d1eab1d"])
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, SHA256HashData, TargetProcessId])
| sort(@timestamp, order=desc, limit=1000)

Looks for: nltest, net, or net1 commands that enumerate domain controllers or trust relationships. Accomplishes: catches a recurring pre-lateral-movement discovery step, but stays analyst-led because help-desk and domain administrators use the same utilities.

Trace: H02 · Decision Q02

// HUNT: Akira-style domain and trust discovery
// HYPOTHESIS: H02
// USE: hunt
// MITRE: T1482, T1018
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 14d — discovery commonly precedes impact by minutes to days
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, CommandLine, ParentBaseFileName, aid, ComputerName, UserName, @timestamp
// FALSE POSITIVES: domain administration, identity troubleshooting, deployment scripts
// TUNING: Exclude approved administrative accounts and known management hosts only after reviewing their exact commands
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 1209600000)
| FileName = /^(?:nltest|net|net1)(?:\.exe)?$/i
| CommandLine = /(?:\/dclist:|\/domain_trusts|domain trust|domain_controller)/i
| groupBy([aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], function=[count(as=Executions), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)

Looks for: command interpreters and service tools issuing stop, delete, disable, uninstall, or kill actions against endpoint security, backup, or recovery components. Accomplishes: targets the pre-impact defense-evasion boundary with actionable host and user context.

Trace: H03 · A01

// HUNT: Security-control impairment before ransomware impact
// HYPOTHESIS: H03
// USE: alert-candidate
// MITRE: T1562.001
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 7d — high-risk preparation requires prompt review
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, CommandLine, ParentBaseFileName, aid, ComputerName, UserName, @timestamp
// FALSE POSITIVES: authorized security-agent maintenance, upgrades, and incident-response containment
// TUNING: Exclude only approved maintenance account, host, parent, and command combinations with change-window evidence
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 604800000)
| FileName = /^(?:powershell|pwsh|cmd|sc|net|net1|taskkill|wmic|msiexec)(?:\.exe)?$/i
| CommandLine = /(?:stop|delete|disable|uninstall|remove|terminate|taskkill).{0,100}(?:defender|crowdstrike|falcon|sentinel|carbonblack|sophos|trend|mcafee|veeam|backup|antivirus|endpoint|edr|vss)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=1000)

Looks for: Ngrok, Cloudflare Tunnel, RustDesk, AnyDesk, LogMeIn, or MobaXterm execution with tunnel or remote-session arguments. Accomplishes: surfaces operator access and C2 tooling, but needs same-host network context and a local approval inventory.

Trace: H04 · Decision Q04

// HUNT: Akira-associated tunnel and remote-access tooling
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1572, T1219
// CONF: medium
// FP: high
// COST: medium
// TIMEFRAME: 14d — remote tooling may persist across several operator sessions
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, ImageFileName, CommandLine, ParentBaseFileName, aid, ComputerName, UserName, TargetProcessId, @timestamp
// FALSE POSITIVES: approved developer tunnels, remote support, and administrator troubleshooting
// TUNING: Exclude owner-approved binary hash, signer, account, host group, and command pattern combinations
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 1209600000)
| FileName = /^(?:ngrok|cloudflared|rustdesk|anydesk|logmein|mobaxterm)(?:\.exe)?$/i
| CommandLine = /(?:tcp|http|tunnel|connect|service|server|relay|remote|access)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData, TargetProcessId])
| sort(@timestamp, order=desc, limit=1000)

Looks for: an archive utility and an exfiltration-capable transfer client appearing on one endpoint during 24 hours. Accomplishes: highlights the staging-to-exfiltration handoff, while deliberately requiring timeline review because backup and migration jobs can look identical.

Trace: H05 · Decision Q05

// HUNT: Same-host archive staging and transfer tooling
// HYPOTHESIS: H05
// USE: hunt
// MITRE: T1560.001, T1567.002
// CONF: medium
// FP: high
// COST: medium
// TIMEFRAME: 24h — bounds same-host staging and transfer correlation
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, CommandLine, aid, ComputerName, UserName, @timestamp
// FALSE POSITIVES: backup jobs, software packaging, migration work, and administrator file transfers
// TUNING: Exclude approved backup and migration hosts plus service accounts; then require unusual archive paths or destinations
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 86400000)
| FileName = /^(?:rar|winrar|7z|tar|rclone|winscp|winscpnet|filezilla)(?:\.exe)?$/i
| selfJoinFilter(field=[aid], where=[{FileName = /^(?:rar|winrar|7z|tar)(?:\.exe)?$/i}, {FileName = /^(?:rclone|winscp|winscpnet|filezilla)(?:\.exe)?$/i}])
| groupBy([aid, ComputerName], function=[count(as=Executions), collect(FileName, limit=20), collect(UserName, limit=20), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)

Looks for: vssadmin, WMIC, PowerShell, or wbadmin commands that delete shadow copies, recovery catalogs, or system-state backups. Accomplishes: catches a durable ransomware impact precursor that warrants urgent review and careful maintenance-window suppression.

Trace: H06 · A02

// HUNT: Recovery inhibition through shadow-copy or catalog deletion
// HYPOTHESIS: H06
// USE: alert-candidate
// MITRE: T1490
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 7d — destructive actions require prompt review
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, CommandLine, ParentBaseFileName, aid, ComputerName, UserName, @timestamp
// FALSE POSITIVES: approved backup maintenance, gold-image preparation, and storage cleanup
// TUNING: Exclude only documented maintenance accounts, hosts, and exact command patterns within approved windows
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 604800000)
| FileName = /^(?:vssadmin|wmic|powershell|pwsh|wbadmin)(?:\.exe)?$/i
| CommandLine = /(?:delete|remove).{0,80}(?:shadowcopy|shadows|catalog|systemstatebackup)|(?:shadowcopy|shadows|catalog|systemstatebackup).{0,80}(?:delete|remove)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=1000)

Looks for: PsExec, WMI, service-control, or remote-shell command patterns associated with lateral execution. Accomplishes: provides a domain-controller spreader pivot when restricted to known critical servers, but is intentionally hunt-only until asset role and fan-out are validated.

Trace: H07 · Decision Q07

// HUNT: Remote execution from potential ransomware spreaders
// HYPOTHESIS: H07
// USE: hunt
// MITRE: T1021
// CONF: medium
// FP: high
// COST: medium
// TIMEFRAME: 7d — high-impact lateral movement requires prompt scoping
// REQUIRES: Falcon endpoint event repository; ProcessRollup2; FileName, CommandLine, ParentBaseFileName, aid, ComputerName, UserName, @timestamp; tenant critical-server or domain-controller host context
// FALSE POSITIVES: software deployment, domain administration, backup orchestration, and vulnerability scanning
// TUNING: Restrict to verified domain controllers or critical servers and exclude approved management parents, accounts, and command patterns
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 604800000)
| (FileName = /^(?:psexec|psexesvc|wmic|sc|winrs)(?:\.exe)?$/i or CommandLine = /(?:wmiexec\.py|\/node:|sc\.exe \\|winrs -r:|psexec)/i)
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine])
| sort(@timestamp, order=desc, limit=1000)