Akira Ransomware Activity: Suspicious Workstation Names in Logon Events

Detects logon events (successful or failed) originating from workstations with suspicious or generic names, which can be an indicator of threat actor activity. This pattern has been associated with Akira ransomware campaigns.