The article describes a recent intrusion linked to the Akira ransomware operation. The attackers obtained initial access by brute-forcing a disabled local SSL VPN account, then moved on to credential discovery, Kerberoasting, and lateral movement over RDP. Before launching encryption, they cleared logs and removed shadow copies. Notably, the entire sequence was visible through firewall syslog data and Windows EVTX logs, without relying on endpoint detection tooling. The report highlights how combining perimeter and endpoint telemetry can expose ransomware activity in its early stages.
The investigation relied exclusively on SSL VPN firewall logs and Windows event log exports gathered from domain controllers and member servers. Event IDs including 4624 , 4688 , 4769 , 1102 , and 7036 were correlated to reconstruct the complete kill chain from initial access through final impact. The observed techniques included credential stuffing, domain discovery, Kerberoasting, RDP authentication, log clearing, and shadow copy deletion. No memory images or EDR telemetry were needed to map the intrusion.
The report recommends tightening remote access security, enforcing MFA, removing disabled accounts from firewall access lists, and strengthening authentication lockout policies. It also advises enabling detailed process auditing with Event ID 4688 across all systems, increasing security log retention, and forwarding critical logs to external storage. Detection content should specifically cover RC4-based Kerberos tickets, vssadmin shadow copy deletion, and unexpected PowerShell commands using -EncodedCommand . Consistent time synchronization across infrastructure is also essential for reliable correlation.
When any of the identified indicators appear, responders should immediately isolate the compromised VPN account and quarantine affected systems. Relevant firewall and EVTX logs should be preserved, credentials reset, compromised accounts disabled, and shadow copies restored from clean backups where available. A full forensic review should then be performed to identify any additional persistence or follow-on activity, while ransomware response procedures are activated. Stakeholders should be informed promptly, and public disclosure should be considered where required.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
Regression Test Script: Bash script leveraging curl (works on Linux attacker box). Adjust variables for real environment.
Cleanup Commands: Remove any temporary files and reset firewall rate‑limiting (if altered).
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
