QILIN Ransomware: Aggressive Campaign Targets Construction & Tech — Detection & Intel

---
title: Potential ConnectWise ScreenConnect Authentication Bypass
id: 8f1d6f3e-1a2b-4c5d-9e6f-7a8b9c0d1e2f
description: Detects exploitation attempts of ConnectWise ScreenConnect vulnerabilities (CVE-2024-1708) via suspicious URI paths or webshell activity.
status: experimental
date: 2026/05/23
author: Security Arsenal Labs
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/SetupWizard.aspx'
            - '/WebService.asmx/'
            - 'Host='
            - 'Command='
    condition: selection
falsepositives:
    - Legitimate administrative setup (rare in production)
level: high
---
title: Qilin Ransomware Pre-Encryption VSS Deletion
id: a2b3c4d5-6e7f-8a9b-0c1d-2e3f4a5b6c7d
description: Detects the deletion of Volume Shadow Copies using vssadmin or wmic, a common precursor to ransomware encryption used by Qilin affiliates.
status: experimental
date: 2026/05/23
author: Security Arsenal Labs
logsource:
    category: process_creation
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 'Delete Shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'shadowcopy delete'
    condition: 1 of selection_*
falsepositives:
    - System administrator maintenance
level: critical
---
title: Suspicious PowerShell Child Process Execution
id: b3c4d5e6-7f8a-9b0c-1d2e-3f4a5b6c7d8e
description: Detects PowerShell spawning suspicious child processes often associated with Qilin payload execution or lateral movement (e.g., launching runDLL32 or regsvr32 with base64 encoded commands).
status: experimental
date: 2026/05/23
author: Security Arsenal Labs
logsource:
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\powershell.exe'
    selection_child:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
    selection_flags:
        CommandLine|contains: ' -enc ' or CommandLine|contains: ' -EncodedCommand '
    condition: all of selection_*
falsepositives:
    - Legitimate system administration scripts
level: high

// Hunt for lateral movement and SmarterMail anomalies associated with Qilin TTPs
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
// Identify suspicious processes often used by Qilin (e.g. PsExec, PowerShell, Cobalt Strike)
| where FileName in~ ('powershell.exe', 'psexec.exe', 'psexec64.exe', 'wmic.exe', 'cmd.exe')
// Filter for network connections or lateral movement indicators
| where ProcessCommandLine has any("-enc", "-encodedcommand", "Invoke-Command", "New-PSSession") 
   or InitiatingProcessFileName has_any("winword.exe", "excel.exe", "powershell.exe")
// Correlate with SmarterMail web server processes if applicable
| join kind=leftouter (DeviceProcessEvents 
    | where FileName =~ "MailService.exe" or FolderPath contains "SmarterMail" 
    | project Timestamp, DeviceName, AccountName, SmarterMailActivity=ProcessCommandLine
) on DeviceName, Timestamp
| project Timestamp, DeviceName, FileName, ProcessCommandLine, SmarterMailActivity
| order by Timestamp desc

<#
.SYNOPSIS
    Qilin Ransomware Hardening and Detection Script
.DESCRIPTION
    Checks for indicators of Qilin activity (RDP anomalies, Scheduled Tasks) 
    and applies immediate hardening rules.
#>

Write-Host "[*] Starting Qilin Threat Hunt & Hardening..." -ForegroundColor Cyan

# 1. Check for recent Scheduled Tasks (Persistence)
Write-Host "[+] Checking for Scheduled Tasks created/modified in the last 7 days..."
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | 
    Select-Object TaskName, Date, Author, Actions | Format-Table -AutoSize

# 2. Hunt for recent VSS Shadow Copy deletions
Write-Host "[+] Checking System Event Log for VSS Deletion events (Event ID 7036/1 from VSS)..."
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-24); Id=1} -ErrorAction SilentlyContinue | 
    Where-Object {$_.Message -like '*delete*' -and $_.Message -like '*shadow*'} | 
    Select-Object TimeCreated, Message | Format-List

# 3. Audit RDP Users
Write-Host "[+] Listing active RDP sessions..."
query user

# 4. Hardening: Block incoming RDP if not required (Enable Firewall Rule)
Write-Host "[!] REMEDIATION: Disabling RDP via Firewall if possible..."
# Uncomment the line below to enforce blocking
# Disable-NetFirewallRule -DisplayGroup "Remote Desktop"
Write-Host "[*] Script complete. Review findings immediately." -ForegroundColor Green


---