title: Akira - shadow copies removed by WMI-spawned hidden PowerShell
id: 6f3c2a8e-4b1d-4c7a-9e55-0a1b2c3d4e51
status: experimental
description: >-
  The Akira-branded encryptor (builds 101bd45a and 98877635) deletes Volume Shadow Copies before encrypting
  anything. It launches PowerShell through WMI Win32_Process.Create with a hidden Win32_ProcessStartup,
  so the parent is WmiPrvSE.exe, not the ransomware process.
references:
  - https://git.shaddy43.com/shaddy43/MalwareAnalysisSeries/src/branch/main/Akira
author: Shayan Ahmed Khan
date: 2026/10/13
tags:
  - attack.impact
  - attack.t1490
  - attack.execution
  - attack.t1047
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:
      - 'Win32_Shadowcopy'
      - 'Remove-WmiObject'
  condition: selection
falsepositives:
  - Administrators deleting shadow copies remotely through WMI (rare; verify the operator)
level: high