QILIN Ransomware: 16 New Victims Posted — Aggressive Mail Server Exploitation & Sector Targeting Analysis

---
title: Potential Exchange Deserialization Exploit (CVE-2023-21529)
id: 38c3a8f8-7d88-4b3d-9c5a-1d2f3g4h5i6j
description: Detects suspicious process spawns by w3wp.exe (IIS) associated with Exchange deserialization vulnerabilities.
status: experimental
date: 2026/05/13
author: Security Arsenal
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\w3wp.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\bash.exe'
    condition: selection
falsepositives:
    - Administrative management scripts
level: critical
---
title: SmarterMail Unrestricted File Upload (CVE-2025-52691)
id: 9d7e6f5e-4c2a-3b1d-0e9f-2a1b2c3d4e5f
description: Identifies suspicious web shell-like activity or file creation in SmarterMail directories.
status: experimental
date: 2026/05/13
author: Security Arsenal
logsource:
    category: file_creation
    product: windows
detection:
    selection:
        TargetFilename|contains: 'SmarterMail'
        TargetFilename|contains:
            - '.aspx'
            - '.ashx'
            - '.asp'
    condition: selection
falsepositives:
    - Legitimate software updates
level: high
---
title: Qilin Ransomware Data Staging Pattern
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects usage of Rclone or WinSCP often used by Qilin affiliates for data exfiltration prior to encryption.
status: experimental
date: 2026/05/13
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        Image|endswith:
            - '\rclone.exe'
            - '\winscp.exe'
            - '\filezilla.exe'
    selection_network:
        CommandLine|contains:
            - 'sync'
            - 'copy'
            - 'sftp://'
    condition: all of selection_*
falsepositives:
    - Legitimate admin backups
level: medium

// Hunt for potential Qilin lateral movement and staging via PowerShell and Rclone
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has "-enc" or ProcessCommandLine has "DownloadString" or ProcessCommandLine has "IEX"
| where InitiatingProcessFileName in~ ("w3wp.exe", "svchost.exe", "explorer.exe")
| join kind=leftouter (DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (443, 80, 21, 22) or InitiatingProcessFileVersion =~ "2.0.0.0" // Generic Rclone sig
| summarize ConnectionCount=count(), RemoteIPs=make_set(RemoteIP) by DeviceId, InitiatingProcessFileName) on DeviceId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, ConnectionCount, RemoteIPs
| order by Timestamp desc

<#
.SYNOPSIS
    Qilin Ransomware Rapid Response Audit
.DESCRIPTION
    Checks for Shadow Copy deletion, scheduled task persistence, and recent PowerShell script block logs.
#>

Write-Host "[*] QILIN THREAT CHECK - $(Get-Date)" -ForegroundColor Cyan

# 1. Check for Volume Shadow Copy Deletion Attempts
Write-Host "[+] Checking Event Log 5148 (Shadow Copy Deletion)..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ShadowCopy/Operational'; ID=25; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($vssEvents) { $vssEvents | Select-Object TimeCreated, Message | Format-Table -AutoSize } else { Write-Host "No VSS deletion events found." -ForegroundColor Green }

# 2. Hunt for Suspicious Scheduled Tasks (Common Qilin Persistence)
Write-Host "[+] Enumerating Scheduled Tasks created/modified in last 7 days..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | ForEach-Object {
    $task = $_
    $action = $task.Actions.Execute
    if ($action -match 'powershell' -or $action -match 'cmd' -or $action -match 'rclone') {
        Write-Host "SUSPICIOUS TASK FOUND: $($task.TaskName)" -ForegroundColor Red
        Write-Host "Action: $action"
    }
}

# 3. Check for Recent Rclone or WinSCP Executions
Write-Host "[+] Checking for recently executed data transfer tools..." -ForegroundColor Yellow
$recentProcesses = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | 
    Where-Object {$_.Message -match 'rclone' -or $_.Message -match 'winscp' -or $_.Message -match 'filezilla'}

if ($recentProcesses) { $recentProcesses | Select-Object TimeCreated, Message | Format-List } else { Write-Host "No suspicious transfer tools detected." -ForegroundColor Green }