Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Summary

An Akira ransomware affiliate bypassed EDR protections by rebooting a compromised system into Safe Mode with Networking. This technique disabled the Huntress agent and Microsoft Defender real-time protection, allowing the attacker to operate with significantly reduced visibility. Although the anti-EDR tactic successfully blinded security tools, Safe Mode’s constrained memory environment caused the ransomware execution to fail because of virtual memory exhaustion.

Investigation

The investigation traced initial access to a credential spray against a SonicWall SSL VPN that lacked MFA. The attacker used RDP to access a domain controller, conducted extensive Active Directory enumeration, and exfiltrated data with WinRAR and s5cmd. Analysts reconstructed the intrusion using VPN logs, registry modifications enabling AnyDesk persistence in Safe Mode, and system error logs showing memory failures during ransomware execution.

Mitigation

Organizations should enforce multi-factor authentication (MFA) across all VPN connections and monitor for credential spraying activity. Maintaining EDR coverage across endpoints and ingesting VPN and Windows Event Logs into a SIEM is essential for visibility. Security teams should also alert on boot configuration changes involving msconfig.exe or bcdedit and monitor for unexpected reboots into Safe Mode.

Response

If unauthorized VPN access or credential spraying is detected, organizations should immediately rotate affected Active Directory and VPN credentials. Any unexpected Safe Mode reboot should be treated as a potential compromise and the affected system isolated promptly. Responders should also investigate AnyDesk installation and registry modifications involving SafeBoot service configurations.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary, having gained initial access, seeks to harvest Active Directory user information to facilitate lateral movement. They execute a command to output user lists to a file named AdUsers.txt. To prepare this data for exfiltration to a cloud storage service, the adversary uses WinRAR.exe with specific arguments (a -ep1 -scul -r0 -iext -imon1) intended to automate the archiving process while minimizing metadata footprint. This activity is designed to trigger the rule’s specific file-name and command-line pattern detections.

• Regression Test Script:

  # Simulation Script: Triggering WinRAR Exfiltration Detection
  
  # 1. Trigger 'selection_file_creation' (Event ID 11)
  Write-Output "User: Admin, Group: Domain Admins" | Out-File -FilePath "$env:TEMPAdUsers.txt"
  Write-Host "[+] Created AdUsers.txt in TEMP"
  
  # 2. Trigger 'selection_winrar_args' (Event ID 1)
  # Note: This requires WinRAR to be installed on the system.
  $winrarPath = "C:Program FilesWinRARWinRAR.exe"
  if (Test-Path $winrarPath) {
      $args = "a -ep1 -scul -r0 -iext -imon1 $env:TEMPexfil_package.rar $env:TEMPAdUsers.txt"
      Start-Process -FilePath $winrarPath -ArgumentList $args -Wait
      Write-Host "[+] Executed WinRAR with specific arguments"
  } else {
      Write-Error "[!] WinRAR not found at $winrarPath. Simulation incomplete."
  }

• Cleanup Commands:

  # Cleanup Simulation Artifacts
  Remove-Item -Path "$env:TEMPAdUsers.txt" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPexfil_package.rar" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPbenign_test_file.txt" -Force -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete."