Detection: Akira Restart Manager process termination (T1489)
| Signal | Source | Notes |
|---|---|---|
Rapid RestartManager 10000 / 10001 session start and end events from an unsigned process, followed by terminations of database / Office processes |
Application log, process termination (Sysmon 5 / EDR) | The sample calls RmStartSession → RmRegisterResources(file) → RmGetList → RmShutdown(RmForceShutdown) for each locked target file |
WTSEnumerateProcessesW from the same process shortly before |
EDR API telemetry | Builds the protected-PID list of 20 system processes it will not kill |
There is no Sigma rule yet. Restart Manager event volume differs a lot between environments, so build a baseline first.