Akira UnPAC The Hash Credential Theft

Tim Peck@timpeck

•updated Oct 9, 2025•2•0•164

Detects a potential 'UnPAC the Hash' Kerberos attack, a technique used by Akira ransomware. The attack involves requesting an Active Directory certificate and then using it for a User-to-User (U2U) Kerberos authentication with PKINIT to extract NTLM hashes.