Reconstructing an Akira-Attributed Ransomware Kill Chain from Firewall and Windows Logs
Summary
A log-based reconstruction of an Akira-attributed intrusion traced SSLVPN brute force, Kerberoasting, RDP movement and pre-encryption actions. Joining firewall and Windows logs exposed the sequence and informed practical detection and retention guidance.
Key points
- A forgotten local SSLVPN account, disabled in Active Directory but still provisioned on the firewall without MFA, was successfully brute-forced.
- Windows process events showed discovery commands, while RC4 Kerberos ticket requests from the jump host indicated Kerberoasting.
- RDP logons connected the jump host to servers and domain controllers; related events indicated the attacker had domain-level privileges.
- Before encryption, the attacker cleared a Security event log, stopped endpoint protection services and deleted shadow copies with vssadmin.
- Joining firewall and Windows event logs connected the initial access evidence to later activity; limited retention and unsynchronized timestamps impeded analysis.
- Recommendations include reconciling local VPN accounts, enforcing MFA, enabling and retaining process auditing, alerting on Kerberos and log-clearing events, and synchronizing system time.
Article Details
- Attack Vectors
- A forgotten local SSLVPN account without MFA was brute-forced and successfully used for initial access; it had been deprovisioned in Active Directory but remained provisioned on the firewall.
- RC4-encrypted Kerberos ticket requests from the jump host against three service accounts indicated Kerberoasting.
- RDP logons from the jump host were used for lateral movement to the file server, domain controllers, and backup server.
- The attacker created an account in a non-default OU and added it to a built-in group.
- Encoded PowerShell commands were used for reconnaissance of backup infrastructure and shadow-copy state.
- The attacker cleared the Security event log, stopped endpoint-protection services, deleted shadow copies, and then encrypted files.
- Defensive Notes
- Inventory local SSLVPN accounts, enforce MFA, and reconcile them against the directory of record; remove accounts that are no longer needed.
- Alert on more than 50 failed SSLVPN authentications from one source within an hour.
- Enable EID 4688 process auditing on Windows hosts and increase Security log capacity to at least 1 GB.
- Alert on RC4 Kerberos tickets requested for multiple SPNs within a short window from one workstation.
- Forward EID 1102 off-host and treat any security-log clearing event as incident-grade.
- Audit command-line execution of vssadmin and wmic shadowcopy, and alert on execution.
- Synchronize firewall and host clocks to the same authoritative NTP source, and retain perimeter and endpoint logs long enough to correlate them.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolSuccessful RDP logons from the jump host reached the file server, both domain controllers, and the backup server.T1059.001 · PowerShellPowerShell sessions used the -EncodedCommand flag for reconnaissance of backup infrastructure and shadow-copy state.T1059.003 · Windows Command ShellProcess creation events showed cmd.exe launching discovery commands including nltest.exe, net.exe, and whoami.exe.T1070.001 · Clear Windows Event LogsThe Security event log on the jump host was cleared, recorded as EID 1102.T1078.001 · Default AccountsThe intrusion used a forgotten local SSLVPN account that was successfully brute-forced.T1087 · Account DiscoveryProcess events showed net.exe queries for Domain Admins and Enterprise Admins groups.T1098.007 · Additional Local or Domain GroupsThe newly created account was added to a built-in group using its Well-Known SID.T1110 · Brute ForceFirewall authentication logs showed repeated failures from a single source IP followed by a successful login to the local SSLVPN account.T1133 · External Remote ServicesThe attacker gained initial access through the organization's SSLVPN.T1136.002 · Domain AccountThe attacker created a new account in a non-default OU in the Active Directory environment.T1482 · Domain Trust DiscoveryThe attacker ran nltest.exe with /dclist: during discovery.T1486 · Data Encrypted for ImpactFile encryption followed the log clearing, service stopping, and shadow-copy deletion.T1490 · Inhibit System RecoveryThe attacker ran vssadmin delete shadows /all /quiet across reachable hosts before encryption.T1558.003 · KerberoastingRC4-encrypted Kerberos ticket requests against three service accounts from the jump host indicated Kerberoasting.T1562.001 · Disable or Modify ToolsThe attacker stopped endpoint-protection services using sc.exe and net stop before encryption.
Threat Actors
Malware
Products
Microsoft Active DirectoryThe environment was a single-site Active Directory forest behind a perimeter NGFW.Microsoft WindowsThis write-up reconstructs an Akira-attributed intrusion by joining SSLVPN syslog with Windows EVTX to show how the attackers gained access, escalated privileges, and prepared for ransomware deployment.