New VM Instantiation on Hypervisor via VHDX Creation — Akira EDR Evasion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects the creation of a new .vhdx virtual disk file by hypervisor management processes. This behavior is used by threat actors, specifically Akira ransomware, to instantiate new virtual machines that lack organizational security tooling to evade endpoint detection before proceeding with malicious activities.