title: Akira - operator launch syntax
id: 0d9e7b14-2f6a-4a3c-8b71-5c4d3e2f1a60
status: experimental
description: >-
  Command-line options parsed by the Akira-branded encryptor (builds 101bd45a and 98877635).
  The options are the same in both builds.
references:
  - https://git.shaddy43.com/shaddy43/MalwareAnalysisSeries/src/branch/main/Akira
author: Shayan Ahmed Khan
date: 2026/10/13
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '--encryption_path='
      - '--share_file='
      - '--encryption_percent='
  flag:
    CommandLine|contains: '-localonly'
  condition: selection or flag
falsepositives:
  - Unlikely; '-localonly' alone is generic, so tune that branch if it is noisy
level: high