CL0P Ransomware Gang: 40 New Victims Posted — Sector Targeting Analysis & Detection Rules

---
title: CL0P Edge VPN or Remote Access Exploitation Followed by Suspicious Child Process
id: 8d0d2d90-7b7b-4f3a-9d3c-cl0pedge0001
status: experimental
description: Detects suspicious process execution spawned by VPN, firewall, remote access, Exchange, ScreenConnect, or file-transfer service contexts consistent with post-exploitation after edge compromise.
author: Security Arsenal Detection Engineering
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/06
modified: 2026/08/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
  - attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '/vpnclient.exe'
      - '/vpnd.exe'
      - '/CheckPoint*'
      - '/ScreenConnect*'
      - '/MsExchange*'
      - '/w3wp.exe'
      - '/java.exe'
      - '/tomcat*.exe'
      - '/nginx.exe'
      - '/httpd.exe'
  selection_child:
    Image|endswith:
      - '/cmd.exe'
      - '/powershell.exe'
      - '/pwsh.exe'
      - '/wscript.exe'
      - '/cscript.exe'
      - '/mshta.exe'
      - '/rundll32.exe'
      - '/regsvr32.exe'
      - '/bitsadmin.exe'
      - '/curl.exe'
      - '/wget.exe'
  filter_known_good:
    CommandLine|contains:
      - 'Exchange HealthChecker'
      - 'ScreenConnect.ClientService'
      - 'Windows Defender'
  condition: selection_parent and selection_child and not filter_known_good
falsepositives:
  - Legitimate management agents and Exchange IIS worker processes
level: high
---
title: CL0P Pre-Encryption Staging Archive and Cloud Sync Exfiltration
id: 8d0d2d90-7b7b-4f3a-9d3c-cl0pexil0002
status: experimental
description: Detects archive creation, recursive collection, and cloud sync or transfer tooling near sensitive directories before ransomware detonation or leak extortion.
author: Security Arsenal Detection Engineering
references:
  - https://securityarsenal.com/darkside
date: 2026/08/06
modified: 2026/08/06
tags:
  - attack.collection
  - attack.t1560
  - attack.exfiltration
  - attack.t1567
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '/7z.exe'
      - '/7za.exe'
      - '/rar.exe'
      - '/winrar.exe'
      - '/tar.exe'
      - '/rclone.exe'
      - '/megacmd.exe'
      - '/aws.exe'
      - '/azcopy.exe'
      - '/gsutil.exe'
      - '/curl.exe'
      - '/wget.exe'
      - '/filezilla.exe'
      - '/pscp.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' add '
      - ' -r'
      - ' recurse'
      - ' copy'
      - ' sync'
      - ' move'
      - ' /s'
      - '\\'
      - 'http'
      - 's3:'
      - 'blob'
      - 'mega:'
  selection_paths:
    CommandLine|contains:
      - 'Users'
      - 'Documents'
      - 'Finance'
      - 'Accounting'
      - 'HR'
      - 'Payroll'
      - 'Backup'
      - 'Shared'
      - 'FileServer'
  filter_admin:
    User|contains:
      - 'SYSTEM'
      - 'BackupExec'
      - 'Veeam'
  condition: selection_tool and selection_args and selection_paths and not filter_admin
falsepositives:
  - Enterprise backup, endpoint DLP, software packaging, and admin scripts
level: high
---
title: CL0P Lateral Movement and Anti-Recovery via WMI PsExec Admin Shares Shadow Copy Tamper
id: 8d0d2d90-7b7b-4f3a-9d3c-cl0plat0003
status: experimental
description: Detects remote service creation, WMI process call create, admin-share writes, Cobalt Strike style named pipes, and Volume Shadow Copy deletion often used immediately before encryption.
author: Security Arsenal Detection Engineering
references:
  - https://securityarsenal.com/darkside
date: 2026/08/06
modified: 2026/08/06
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.t1047
  - attack.t1569
  - attack.defense_evasion
  - attack.t1070
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_lateral:
    Image|endswith:
      - '/psexec.exe'
      - '/psexesvc.exe'
      - '/wmic.exe'
      - '/wmiexec.vbs'
      - '/winrm.cmd'
      - '/powershell.exe'
      - '/cmd.exe'
    CommandLine|contains:
      - '\\'
      - 'ADMIN$'
      - 'IPC$'
      - 'CreateService'
      - 'start service'
      - 'process call create'
      - 'Invoke-WMIMethod'
      - 'Enter-PSSession'
  selection_shadow:
    Image|endswith:
      - '/vssadmin.exe'
      - '/bcdedit.exe'
      - '/wbadmin.exe'
      - '/powershell.exe'
      - '/wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'shadowcopy delete'
      - 'Delete Shadows'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'delete catalog'
  selection_pipe:
    CommandLine|contains:
      - '\\.\pipe\'
      - 'postex'
      - 'msagent'
      - 'status_'
  condition: selection_lateral or selection_shadow or selection_pipe
falsepositives:
  - SCCM, Intune, PDQ, Ansible/WinRM, admin remote management
level: critical

let Lookback = 7d;
let SuspiciousTools = dynamic(["psexec.exe","psexesvc.exe","wmic.exe","rclone.exe","7z.exe","rar.exe","winrar.exe","azcopy.exe","aws.exe","gsutil.exe","vssadmin.exe","bcdedit.exe","curl.exe","wget.exe","mshta.exe","rundll32.exe"]);
let AdminShareHosts =
DeviceNetworkEvents
| where Timestamp >= ago(Lookback)
| where RemotePort in (445,135,5985,5986,3389,22)
| where InitiatingProcessFileName has_any (SuspiciousTools) or InitiatingProcessCommandLine has_any ("ADMIN$","IPC$","CreateService","process call create","Enter-PSSession")
| summarize NetHits=count(), FirstNet=min(Timestamp), LastNet=max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine;
let Staging =
DeviceProcessEvents
| where Timestamp >= ago(Lookback)
| where FileName has_any (SuspiciousTools) or ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","bootstatuspolicy ignoreallfailures","process call create","ADMIN$","rclone copy","rclone sync","7z a","rar a","-mx9","s3:","blob.core.windows.net")
| summarize ProcHits=count(), FirstProc=min(Timestamp), LastProc=max(Timestamp), Commands=make_set(ProcessCommandLine, 20) by DeviceId, DeviceName, AccountName, FileName, SHA256;
let FileDrops =
DeviceFileEvents
| where Timestamp >= ago(Lookback)
| where FolderPath has_any ("ADMIN$","ProgramData","Users\\Public","AppData\\Local\\Temp","Windows\\Temp")
| where FileName endswith_any (".zip",".7z",".rar",".tar",".gz",".exe",".dll",".ps1",".bat",".vbs",".js")
| summarize FileHits=count(), FirstFile=min(Timestamp), LastFile=max(Timestamp), Files=make_set(FolderPath, 20) by DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256;
Staging
| join kind=inner AdminShareHosts on DeviceId
| join kind=leftouter FileDrops on DeviceId
| extend Score = ProcHits + NetHits + coalesce(FileHits,0)
| project DeviceName, AccountName, FileName, SHA256, ProcHits, NetHits, FileHits, Score, FirstProc, LastProc, LastNet, Commands, Files
| order by Score desc, LastProc desc;

# Security Arsenal rapid CL0P pre-ransomware triage (read-only by default)
# Run elevated on suspected file servers, jump hosts, Exchange, VPN-adjacent Windows systems, and backup servers.
$Days = 7
$Now = Get-Date
$Since = $Now.AddDays(-1 * $Days)
$Report = [ordered]@{}

Write-Host "[+] Host:" $env:COMPUTERNAME " UTC:" ($Now.ToUniversalTime())

$rdp = Get-ItemProperty -Path 'HKLM:/System/CurrentControlSet/Control/Terminal Server' -ErrorAction SilentlyContinue
$Report.RdpEnabled = ($rdp.fDenyTSConnections -eq 0)
$Report.RdpPort = (Get-ItemProperty -Path 'HKLM:/System/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
Write-Host "[+] RDP Enabled:" $Report.RdpEnabled " Port:" $Report.RdpPort

Write-Host "[+] Scheduled tasks created/modified in last $Days days with suspicious actions"
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
  $task = $_
  $info = Get-ScheduledTaskInfo -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
  $xml = Export-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
  if ($xml -match 'powershell|pwsh|cmd|mshta|wscript|cscript|rundll32|regsvr32|rclone|7z|psexec|wmic|bitsadmin|curl|wget') {
    [pscustomobject]@{Task=$task.TaskPath+$task.TaskName; State=$task.State; LastRun=$info.LastRunTime; NextRun=$info.NextRunTime; Snippet=($xml -replace '\s+',' ').Substring(0,[Math]::Min(500,($xml -replace '\s+',' ').Length))}
  }
} | Sort-Object LastRun -Descending | Format-Table -AutoSize

Write-Host "[+] Volume Shadow Copies"
vssadmin list shadows 2>$null
bcdedit /enum {current} 2>$null | Select-String -Pattern 'recoveryenabled|bootstatuspolicy'

Write-Host "[+] Recent suspicious services/drivers and Run keys"
Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object {$_.PathName -match 'ProgramData|Users\\Public|AppData|Temp|psexec|rclone|7z|mshta|powershell -enc|FromBase64String'} | Select-Object Name,State,StartMode,PathName,StartName | Format-List
Get-ItemProperty -Path 'HKLM:/Software/Microsoft/Windows/CurrentVersion/Run','HKCU:/Software/Microsoft/Windows/CurrentVersion/Run' -ErrorAction SilentlyContinue | Format-List

Write-Host "[+] Recent executable/script/archive writes in staging paths"
$paths = @("$env:ProgramData","$env:PUBLIC","$env:TEMP","$env:WINDIR/Temp")
Get-ChildItem -Path $paths -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt $Since -and $_.Extension -match '\.exe|\.dll|\.ps1|\.bat|\.vbs|\.js|\.zip|\.7z|\.rar|\.tar|\.gz'} | Select-Object FullName,Length,LastWriteTime | Sort-Object LastWriteTime -Descending | Format-Table -AutoSize

Write-Host "[+] Completed. If RDP is exposed or VSS is missing, isolate host and open IR bridge."