Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Akira – DLL Side-Loading via Signed Utility Binaries

Akira Defense Evasion Sentinel
MITRE ATT&CK
DLL
Data Source
DeviceImageLoadEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (akira)
What This Detects
Detects known Akira side-load pairs (consent.exe/icardagt.exe/mfpmp.exe loading msimg32.dll, wmsgapi.dll, version.dll or rtworkq.dll) from a non-system folder – used to run the loader under a trusted, signed process.
Query
DeviceImageLoadEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ ("consent.exe","icardagt.exe","mfpmp.exe")
| where FileName in~ ("msimg32.dll","wmsgapi.dll","version.dll","rtworkq.dll")
| where FolderPath !startswith @"C:\Windows\System32" and FolderPath !startswith @"C:\Windows\SysWOW64"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, SideloadedDll = FileName, FolderPath, InitiatingProcessAccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.