Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Akira – SharpHound/ldapdomaindump/ShareFinder Domain-Trust Enumeration

Akira Discovery Sentinel
MITRE ATT&CK
Domain Trust Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (akira)
What This Detects
Separately from its signed-binary DLL side-loading chain, Akira runs a distinctive set of AD/share enumeration tools — SharpHound, ldapdomaindump and ShareFinder/SharpShares — that don't commonly appear together outside targeted AD reconnaissance.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has_any ("sharphound","ldapdomaindump","sharpshares")
   or ProcessCommandLine has_any ("Invoke-ShareFinder","ldapdomaindump")
| summarize ToolsSeen = make_set(FileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, AccountName
| where array_length(ToolsSeen) >= 2

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.