This Yara rule from ISH Tecnologia's Heimdall Security Research Team detects key components of Akira Ransomware

Hunt Hypothesis

This detection identifies the presence of specific Akira Ransomware artifacts within the environment by matching against known signature patterns defined in the Heimdall Yara rule. Proactively hunting for these indicators is essential to enable early identification and containment of potential ransomware outbreaks before they can encrypt critical assets or disrupt business operations.

YARA Rule

rule MAL_WIN_Akira_Apr25 {
    meta:
        description = "This Yara rule from ISH Tecnologia's Heimdall Security Research Team detects key components of Akira Ransomware"
        author = "0x0d4y-Icaro Cesar"
        date = "2025-04-11"
        score = 90
        reference = "https://ish.com.br/wp-content/uploads/2025/04/A-Anatomia-do-Ransomware-Akira-e-sua-expansao-multiplataforma.pdf"
        hash = "205589629EAD5D3C1D9E914B49C08589"
        id = "76722cb6-70be-465f-9ef1-afd78f694289"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        rule_matching_tlp = "TLP:WHITE"
        rule_sharing_tlp = "TLP:WHITE"
        malpedia_family = "win.akira"

    strings:
        $code_custom_algorithm = { 44 8B CF 90 42 0F B6 4C 0D ?? 83 E9 4E 44 8D 04 89 45 03 C0 B8 09 04 02 81 41 F7 E8 41 03 D0 C1 FA 06 8B C2 C1 E8 1F 03 D0 6B C2 7F 44 2B C0 41 83 C0 7F B8 09 04 02 81 41 F7 E8 41 03 D0 C1 FA 06 8B C2 C1 E8 1F 03 D0 6B C2 7F 44 2B C0 46 88 44 0D ?? 49 FF C1 }
        $code_aes_key_expansion = { 41 8D 41 FF 33 D2 8B 0C ?? 41 8B C1 41 F7 F2 85 D2 75 ?? 44 8B C1 0F B6 C1 0F B6 0C ?? 41 8B C0 48 C1 E8 ?? C1 E1 ?? 0F B6 04 ?? 0B C8 41 8B C0 48 C1 E8 ?? C1 E1 ?? 0F B6 D0 49 C1 E8 ?? 0F B6 04 ?? 0B C8 41 0F B6 C0 C1 E1 ?? 0F B6 14 ?? 0F B6 45 00 0B CA 33 C8 48 FF C5 }
        $akira_str_I = "akira" ascii
        $akira_str_II = "onion" ascii
        $akira_str_III = "powershell" ascii
        $akira_str_IV = "akira_readme.txt" ascii


    condition:
        uint16(0) == 0x5a4d and
        all of ($code_*) and
        all of ($akira_str_*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Akira Ransomware detection rule, including suggested filters and exclusions:

Scenario: Enterprise Backup Agent Scanning Archives
- Context: Legitimate backup solutions like Veeam Backup & Replication or Commvault often create temporary archive files (.vbk, .zip, or proprietary containers) that contain embedded headers, encryption signatures, and metadata structures similar to the Akira ransomware’s file format. When these agents scan or process large volumes of data, they may trigger the Yara rule due to matching byte sequences in their internal logs or temporary staging files.
- Suggested Filter/Exclusion: Add an exclusion for processes running under the Veeam and Commvault service accounts (e.g., SYSTEM, vbrsvc) and exclude file paths containing \Backup\ or \Staging\. Additionally, filter out alerts where the parent process is vbr.exe or commctrl.exe.
Scenario: Scheduled System Maintenance Scripts
- Context: IT administrators frequently deploy scheduled PowerShell scripts (via Task Scheduler) to perform disk cleanup, log rotation, or database maintenance. These scripts often utilize standard compression libraries (like .NET’s System.IO.Compression) which generate temporary files with specific binary signatures that overlap with the Akira ransomware components detected by the rule.
- Suggested Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or cmd.exe running under a known administrative account (e.g., DOMAIN\IT_Ops). Implement a filter to ignore detections occurring during defined maintenance windows (e.g., 02:00 – 04:00 UTC) on servers tagged with the “Maintenance” AD group.
Scenario: Antivirus Engine Real-Time Scanning