Akira ransomware abuses CPU tuning tool to disable Microsoft Defender

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.