Akira Sonicwall byovd weaponization (rwdrv.sys and hlpdrv.sys)

Søren Holm Pedersen@SorenHP

•updated Apr 30, 2026•15•2•447

This is a KQL detection based on the YARA rules by Jason Baker of GuidePoint Security in linked reference - Connected to the Akira ransomware exploits