QILIN Ransomware: 15 New Victims Identified — Cross-Sector Surge & Critical CVE Exploitation

title: Potential ConnectWise ScreenConnect Authentication Bypass
id: 4a8b9c3d-1e2f-4a5b-8c7d-1e2f3a4b5c6d
description: Detects potential exploitation of CVE-2024-1708 involving suspicious paths or query patterns in ConnectWise ScreenConnect web logs.
status: experimental
date: 2026/06/07
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - 'Authenticate'
            - 'Host'
        cs-uri-stem|contains: '/Services/'
    filter:
        cs-uri-query|contains:
            - '.aspx'
            - 'SessionId'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative access
level: critical
---
title: Suspicious PowerShell Encoded Command Length
id: 5b9c0d4e-2f3g-5b6c-9d8e-2f3g4b5c6d7e
description: Detects long encoded commands in PowerShell, often used by Qilin for payload execution and obfuscation.
status: experimental
date: 2026/06/07
author: Security Arsenal
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4103
        Payload|contains|all:
            - ' -Encoded '
    condition: selection | length(Payload) > 1000
falsepositives:
    - Legitimate admin scripts
level: high
---
title: Ransomware Pattern - Volume Shadow Copy Deletion
id: 6c0d1e5f-3g4h-6c7d-0e9f-3g4h5c6d7e8f
description: Detects attempts to delete Volume Shadow Copies using vssadmin or diskshadow, a common precursor to Qilin encryption.
status: experimental
date: 2026/06/07
author: Security Arsenal
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|contains:
            - 'vssadmin.exe'
            - 'diskshadow.exe'
            - 'wmic.exe'
    cmdline:
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
    condition: selection and cmdline
falsepositives:
    - Legitimate system maintenance
level: critical

// Hunt for Qilin lateral movement and staging indicators
// Looks for Rclone usage (common exfil tool) and unusual SMB access
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
| where InitiatingProcessFileName in ("powershell.exe", "cmd.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any ("rclone", "webclient", "downloadstring", "iex")
| extend HostName = DeviceName
| project Timestamp, HostName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| union (
    DeviceFileEvents
    | where Timestamp >= ago(TimeFrame)
    | where FileName in~ ("rclone.exe", "7za.exe", "winrar.exe")
    | project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath
)
| order by Timestamp desc

<#
.SYNOPSIS
    Qilin Ransomware Rapid Triage Script
.DESCRIPTION
    Checks for common Qilin persistence mechanisms and precursor activities.
#>

Write-Host "[!] Starting Qilin Ransomware Triage..." -ForegroundColor Cyan

# 1. Check for recently created Scheduled Tasks (Persistence)
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -ge (Get-Date).AddDays(-1) }
if ($suspiciousTasks) {
    Write-Host "[ALERT] Found scheduled tasks created/modified in the last 24 hours:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, Date, Author | Format-Table
} else {
    Write-Host "[OK] No suspicious recent scheduled tasks." -ForegroundColor Green
}

# 2. Check for Rclone or other archiving tools (Exfil Staging)
$paths = @("C:\Windows\Temp\", "C:\Users\Public\", $env:TEMP)
$maliciousFiles = @("rclone.exe", "7za.exe", "mimikatz.exe", "procdump.exe")

foreach ($path in $paths) {
    if (Test-Path $path) {
        Write-Host "[*] Scanning $path for staging tools..." -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $maliciousFiles -contains $_.Name } | 
        ForEach-Object { Write-Host "[FOUND] $($_.FullName)" -ForegroundColor Red }
    }
}

# 3. Check for Disabled Shadow Copies
try {
    $shadowCopies = Get-WmiObject -Class Win32_ShadowCopy | Measure-Object
    if ($shadowCopies.Count -eq 0) {
        Write-Host "[ALERT] No Volume Shadow Copies found. Potential deletion event." -ForegroundColor Red
    } else {
        Write-Host "[OK] $($shadowCopies.Count) Shadow Copies exist." -ForegroundColor Green
    }
} catch {
    Write-Host "[ERROR] Could not query Shadow Copies." -ForegroundColor DarkYellow
}

Write-Host "[!] Triage Complete." -ForegroundColor Cyan