Akira Threat Actor Domain Account Creation and Enterprise Admin Group Add
Detects the creation of domain accounts named 'backup_DA' or 'backup_EA' and the subsequent addition of the 'backup_EA' account to the 'Enterprise Admins' group. This behavior is associated with the persistence and privilege escalation tactics used by the Akira ransomware group.
Sigma
