Akira Pre-Ransomware: netscan/Invoke-ShareFinder + SMB Sweep Near Credential Dump

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•2

Detects a suspicious sequence of adversary behaviors typically associated with pre-ransomware activity. The rule identifies high-volume SMB scanning (more than 20 unique IPs in 5 minutes) correlated with network share discovery (using tools like netscan.exe or PowerShell scripts such as Invoke-ShareFinder), and optionally links these actions to credential dumping events on the same host (LSASS dumping via comsvcs.dll or NTDS.dit exfiltration via wbadmin) within a 48-hour window.