Akira Ransomware Associated Vulnerable Driver Activity

This detection identifies the use of two drivers, rwdrv.sys and hlpdrv.sys, which have been observed in Akira ransomware campaigns. The activity includes dropping these drivers, creating associated services, and disabling Windows Defender.