Akira: wbadmin.exe Backs Up NTDS.dit and Registry Hives for Credential Extraction
Detects the execution of wbadmin.exe to initiate a backup that specifically targets the NTDS.dit database and registry hives (SYSTEM, SECURITY), then stages them to a path on C:\ProgramData. This pattern is characteristic of credential dumping activities associated with the Akira ransomware, enabling offline extraction of domain credentials.
YARA-L
