Akira Pre-Ransomware Network Share Enumeration via Invoke-ShareFinder or SoftPerfect Network Scanner

Ibrahim Saud@tektrix

•updated Jun 29, 2026•2•0•1

Detects network share enumeration activity associated with Akira ransomware pre-deployment reconnaissance. The rule monitors for the execution of PowerShell PowerView cmdlets such as Invoke-ShareFinder, Find-DomainShare, and Get-NetShare, as well as the execution of the SoftPerfect Network Scanner (netscan.exe), including renamed instances staged in the ProgramData directory.