Akira Ransomware: Shadow Copy Deletion + Recovery Inhibition + Mass File Rename
This rule detects potential Akira ransomware activity by correlating three distinct malicious phases on a network: first, the deletion of volume shadow copies using vssadmin, wmic, or powershell; second, the disabling of system recovery features via bcdedit or wbadmin; and third, high-volume file renaming (indicating encryption) across multiple endpoints. The rule aggregates these events to identify coordinated campaign activity across at least two hosts.
Microsoft Sentinel (KQL)
