Akira Ransomware: Shadow Copy Deletion + Recovery Inhibition + Mass File Rename
Detects coordinated activity characteristic of Akira ransomware, involving the inhibition of system recovery mechanisms (shadow copy deletion, backup catalog deletion, recovery policy modification) followed by high-volume file renaming (indicative of file encryption) across multiple host systems within a short timeframe.
Microsoft Sentinel (KQL)
