Field Notes · Technical Notes September 2, 2026 · 9 min read

Akira in a Microsoft estate: the artifacts I pull, in order.

Akira's current shape is not ransomware on the workstations. It is credential theft, quiet time on the identity plane, bulk egress, then encryption of the hypervisor and the SAN. Workstations often survive. That survival is not a clean bill of health. It is a clue that the operator did not need fleet-wide execution once they held vCenter or a live ESXi shell.

If the victim is a public body in the EU, the legal clocks start at awareness, not at the moment mail comes back: early warning to the national CSIRT, full incident notification, and GDPR Article 33 notification to the supervisory authority. That work runs under counsel. The technical sequence below is what I want happening in the room while those clocks run.

Hour 0 — stop the wrong first moves

Do not power boxes off. Isolate them. Memory, live LSASS state, and an intact Security log beat a cold disk.

Do not flatten ESXi yet. Rebuild is the correct end state and the wrong first action. The hosts hold the only record of how the operator lived on the hypervisor and whether data left.

Do not point Windows AV at VMFS and call it scoping. ESXi is rebuilt from vendor media. What you inspect before the wipe is rogue authorized_keys, esxcli software vib list for unexpected VIBs, whether SSH and the ESXi shell were enabled, and persistence in /etc/rc.local.d/local.sh. Pull /var/log and /scratch/log from every host — vmkernel, hostd, shell, auth — plus SAN controller logs, and snapshot the encrypted datastores if space allows.

Do not discuss what may have been taken in an unprivileged chat. Firewall and netflow for outbound volume in the two weeks before impact, plus any trace of rclone, WinSCP, FileZilla, or MEGA, belongs in a privileged channel.

Hour 0–2 — the identity plane is the control plane

On the domain controllers, before anyone cleans up:

• Security 4624 / 4625, logon types 3 and 10 — especially type 3 onto the hypervisor management network from a non-DC source.
• 4776 NTLM credential validation clustered off-hours.
• 4768 / 4769 Kerberos bursts for service accounts that do not normally request HTTP or CIFS tickets at 02:00.
• 4720 / 4728 / 4732 for new accounts and sudden Domain Admins or Enterprise Admins membership.
• 7045 new services, 4698 new scheduled tasks, 5136 directory object modifications.
• 1102, Security log cleared. Treat that DC as hostile until proven otherwise.
• An IFM of NTDS (ntdsutil → activate instance ntds → ifm → create full), or a shadow copy of C:\Windows\NTDS\ntds.dit plus the SYSTEM hive. Do not copy ntds.dit off a live volume and call it forensics.

DCSync is the high-value identity artifact. Event 4662 on the domain root, access mask 0x100, properties containing 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes) or 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 (DS-Replication-Get-Changes-All), where the subject is not a domain controller computer account. Correlate that 4662 to the 4624 sharing its Logon ID, so you have a source address rather than only an abused account name.

Defender for Identity, where the sensors exist, does the first cut by alert name: directory services replication from a non-DC, suspected DCSync, identity theft via pass-the-hash, suspicious SMB session enumeration. It is not a substitute for the raw 4662. It is how you find the 4662 quickly enough for it to matter.

Contain identity before rebuilding mail. Disable the suspect privileged set except a small break-glass pair on hardware keys, revoke Entra refresh tokens, and use Conditional Access to kill legacy authentication. Isolate one known-good DC without powering it off. If every DC is a virtual machine, copy the hypervisor system and data volumes to offline media before anyone logs into vCenter again.

Hour 2–6 — endpoints that were actually onboarded

The sensor either wrote state or it did not. Holding licenses is not the same as OnboardingState = 1, and this is where a "Defender shop" discovers which server classes were never onboarded at all.

On a healthy device, all of this is true at once:

• Services Sense (MsSense.exe), WinDefend, and WdNisSvc running.
• Get-MpComputerStatus shows AMRunningMode of Normal, with AMServiceEnabled and RealTimeProtectionEnabled true. Note that this cmdlet reports the antimalware engine, not the EDR sensor — it does not return onboarding state.
• Onboarding state comes from the registry: HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status with OnboardingState = 1, SenseIsRunning = 1, and OrgId matching the intended tenant.

When a device does not appear in the portal, the failure is legible, but only if you read the right log. Two different sources are in play and they are routinely confused:

• Microsoft-Windows-SENSE/Operational is the sensor's own log. Event 5 is failure to connect to the service; 6 is not onboarded with no onboarding parameters found; 10 is failure to persist the onboarding information; 25 is failure to reset health status in the registry; 27 is failure to enable EDR mode in Defender.
• The Application log, source WDATPOnboarding, carries the onboarding script's own results. Event 35 means the script could not find the onboarding status registry value; 40 means the onboarding status is not set to 1; 15 means the SENSE service failed to start.

SENSE event 5 after the internet has been cut is the allow-list problem, and it is a predictable own-goal during containment: the wrapper looks fine, the portal stays empty, because the device cannot reach the Defender service endpoints from a network that was severed and then only partially reopened. If you onboard from USB during an incident, allow the Defender endpoints back first and confirm arrival in the portal before declaring the fleet covered.

A silent failure is different. The sensor loads a kernel driver, and a corrupted catalog database fails driver-signature verification. The installer exits zero, the registry value never flips, and nothing obvious is logged in the installer's own output. The fix is catroot2, not catroot:

net stop cryptsvc
ren C:\Windows\System32\catroot2 catroot2.old
net start cryptsvc

Then rerun onboarding. Deleting empty folders under catroot is a folk remedy that sometimes coincides with recovery; catroot2 is the store Cryptographic Services actually rebuilds.

There is a second cause worth knowing, because it connects this section to the next one. If a Defender policy has disabled the antimalware platform, the Early Launch Antimalware driver is unavailable, and the sensor then fails to start with system error 577 or 1058, surfacing as onboarding event 15. A machine can therefore fail to onboard because something already disabled Defender by policy — which is precisely what this ransomware family arranges.

So a handful of devices that silently fail to onboard after an Akira intrusion are not an endpoint-management nuisance until you have looked. Operators blind EDR deliberately. Collect an investigation package from the portal — prefetch, Amcache, SRUM, services, scheduled tasks, a slice of event logs — or image the devices. Use Live Response for the Advanced Threat Protection registry key, SENSE/Operational, and Microsoft-Windows-Windows Defender/Operational events 5001, 5007, 5010, 5012, 1121 (attack surface reduction block) and 1123 (controlled folder access block). Tamper Protection off, plus a 5007 showing that someone wrote exclusions or disabled real-time protection, is a triage candidate rather than a policy-drift ticket.

Hour 2–8 — precursor on the devices the sensor already saw

Advanced hunting, last fourteen days, before anyone reimages the evidence:

DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ ("vssadmin.exe","wmic.exe","wbadmin.exe","bcdedit.exe",
                      "fsutil.exe","wevtutil.exe","ntdsutil.exe")
| where ProcessCommandLine has_any (
    "delete shadows","shadowcopy delete","delete catalog",
    "recoveryenabled no","bootstatuspolicy ignoreallfailures",
    "usn deletejournal","wevtutil cl","ifm","create full")

Same window for rclone, WinSCP, FileZilla, MEGA clients, and network discovery tooling such as SoftPerfect or Advanced IP Scanner — pivot on ProcessVersionInfoCompanyName rather than file name, because the binaries get renamed. Then msconfig.exe and bcdedit.exe invocations that smell like a forced Safe Mode boot.

Safe Mode with Networking is a documented move for this family, because third-party EDR and Defender real-time protection do not run there. The boot itself leaves artifacts: Microsoft-Windows-Kernel-General event 12 carries a BootMode value that distinguishes a safe-mode start from a normal one; Defender Operational 3002 with error 0x8007043C is literally ERROR_NOT_SAFEBOOT_SERVICE, the service declining to start in Safe Mode; System 7036 records Sense, WinDefend, and WdNisSvc stopping. If the operator wanted their own tooling to survive the boot, there will be a service registered under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\. A detection that fires without a successful remediation, in that window, is not a contradiction: the engine saw the file and had no running real-time component to act with.

Bring-your-own-vulnerable-driver is the other route to the same outcome, and since mid-2025 this family has used a specific pair: rwdrv.sys, the legitimate driver shipped with the ThrottleStop CPU tuning utility, registered as a service to obtain kernel-level execution, followed by hlpdrv.sys, also registered as a service, whose narrow job is to write DisableAntiSpyware under SOFTWARE\Policies\Microsoft\Windows Defender by silently invoking regedit.exe. Hunt it in DeviceRegistryEvents and in service-install events, both of which survive the driver file being removed. A silent regedit.exe execution is itself worth an alert in most estates.

One caveat that matters for scoping rather than for detection: Microsoft deprecated DisableAntiSpyware on modern Windows client platforms years ago, so the policy write is not universally effective. It is still attempted, it still works where the platform or servicing level permits, and the attempt is evidence regardless of whether it succeeded. Do not read a failed technique as an absent intruder.

Device isolation from the portal keeps the sensor's tunnel to the service while cutting the device off the LAN. That is the reason to isolate from the console rather than unplug the cable and hope.

Hour 8–24 — egress, then rebuild in the right order

Firewall and proxy telemetry into the SIEM, weighted by outbound bytes rather than allow-and-deny counts. DeviceNetworkEvents and CloudAppEvents for MEGA, public object storage, unusual 443 to hosting providers, and Graph or SharePoint mass download. On hybrid Exchange, look for mailbox export requests and new application consents. This is what answers the question the supervisory authority will ask and that restore-from-backup cannot: did personal data leave.

Recovery order is identity first, then the applications that depend on it. A Server 2008 R2 print server on the production identity plane does not come back as it was; compromise recovery is the moment that workload moves to a supported OS on a segmented network, or off the estate entirely. Mail goes last, because leftover persistence surfaces there after you believe the directory is clean: hidden inbox rules, a service principal holding Mail.ReadWrite, an admin session that minted third-party access.

A clean backup from last month is luck, not architecture, and its date is an assumption until dwell time is established. Replaying an image that already contains the intruder is not recovery. Reset KRBTGT twice with a proper interval between resets to close the golden-ticket window, and rotate every privileged secret, including hypervisor and backup credentials.

Finally, the small thing that gets misfiled: a shared Access database on a server you have already proved clean, which saves instantly from some workstations and hangs for minutes on others, is usually real-time inspection of the .accdb and its .laccdb lock file on every write, with no path exclusion. Check Defender Operational 1123 and 1124 around the hang, set the exclusion, and do not log it as residual ransomware behavior.

What this walkthrough is for

The hypervisor job is won or lost on two things: whether NTDS, hostd, and egress telemetry were preserved before the rebuild, and whether the sensor was truly onboarded when someone said it was. Both are checkable on any estate, today, without an incident in progress. If you check them now and find gaps, that is a finding you can act on cheaply. If you check them during an incident, the answer costs considerably more.

None of the artifacts above require a named victim, and a named victim would not make the query more true.

Related: The Incident Is Contained. That Does Not Mean It Is Closed. · Evidence Gaps Are Findings · Cloud Security Architecture Is an Identity Problem

If you are deciding whether an incident is genuinely closed, or whether the evidence supports the conclusion someone has already written, an independent closure review tests exactly that.