Detection: Akira encrypter (T1486)
| File | Type | Data source | Notes |
|---|---|---|---|
akira_win64_encryptor_101bd45a.yar |
YARA | PE files | Built from strings and byte patterns confirmed in build 101bd45a through Ghidra. The CLI, log and note strings are also present in build 98877635. Not yet run by a YARA engine: test it against a benign corpus before production use |
sigma_akira_launch_syntax.yml |
Sigma | process_creation | Operator command-line options, the same in both builds |
hunting_queries.md |
Hunting | Sysmon / EDR / file triage | .arika → .akira rename bursts, note drops, operator log, footer triage |
False positives:
- The YARA rule’s crypto-constant branch (KCipher-2 table plus ChaCha constants) also needs three codebase-specific strings.
- The Sigma
-localonlybranch alone is generic. Tune it if it is noisy.
None of these rules has been tested against a production log corpus.