Akira Ransomware Malicious Driver Activity

Mitchell V@mvani

•updated Aug 7, 2025•6•1•78

Detects the creation of files and services associated with malicious drivers (hlpdrv.sys, rwdrv.sys) used by Akira ransomware affiliates for defense evasion, as reported by GuidePoint Security. This rule specifically looks for the creation of these driver files and the associated service registrations in the Windows Registry.