---
title: Potential ScreenConnect Authentication Bypass (CVE-2024-1708)
id: a0b1c2d3-e4f5-6789-0123-456789abcdef
status: experimental
description: Detects suspicious authentication attempts and path traversal indicators associated with ConnectWise ScreenConnect vulnerabilities exploited by Qilin.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/05/31
tags:
    - cve.2024.1708
    - attack.initial_access
    - detection.emerging-threats
logsource:
    category: web
detection:
    selection:
        c-uri|contains:
            - '/Bin/ScreenConnect.ashx'
            - '/Host.ashx'
    filter:
        cs-method|contains:
            - 'POST'
        sc-status:
            - 200
            - 500
    condition: selection and filter
falsepositives:
    - Legitimate administrative access
level: high
---
title: Rclone Data Exfiltration Tool Execution
id: b1c2d3e4-f5a6-7890-1234-567890abcdef
status: experimental
description: Detects execution of rclone, a tool frequently used by Qilin affiliates for data exfiltration to cloud storage prior to encryption.
author: Security Arsenal Research
date: 2026/05/31
tags:
    - attack.exfiltration
    - qilin
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\rclone.exe'
            - '/rclone'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'mega'
            - 'pcloud'
    condition: selection
falsepositives:
    - Legitimate backup tasks using rclone
level: high
---
title: VSSAdmin Shadow Copy Deletion
id: c2d3e4f5-a6b7-8901-2345-678901abcdef
status: experimental
description: Detects commands used to delete Volume Shadow Copies, a common step for Qilin to prevent recovery.
author: Security Arsenal Research
date: 2026/05/31
tags:
    - attack.impact
    - qilin
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    condition: selection
falsepositives:
    - System administration tasks (rare)
level: critical

// Hunt for lateral movement and staging activity common in Qilin operations
// Looks for massive file creation in AppData (staging) and unusual SMB access
DeviceProcessEvents  
| where Timestamp >= ago(7d)
| where (ProcessCommandLine contains "copy" and ProcessCommandLine contains "\\\\*") 
       or (FileName in~ ("powershell.exe", "cmd.exe") and ProcessCommandLine contains "New-PSDrive")
| summarize count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, ProcessCommandLine
| where count_ > 5

<#
.SYNOPSIS
    Qilin Ransomware Triage Script
.DESCRIPTION
    Checks for signs of Qilin activity: Scheduled task persistence, VSS shadow deletion, and Rclone usage.
#>

Write-Host "[+] Checking for recent suspicious Scheduled Tasks (Last 24h)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddHours(-24)} | Select-Object TaskName, TaskPath, Date

Write-Host "[+] Checking Security Event Log for VSSAdmin deletion attempts (Event ID 4688)..." -ForegroundColor Cyan
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($Events) {
    $Events | Where-Object {$_.Message -match 'vssadmin.exe' -and $_.Message -match 'delete shadows'} | Select-Object TimeCreated, Message
} else {
    Write-Host "No VSSAdmin events found or log access denied." -ForegroundColor Yellow
}

Write-Host "[+] Scanning for Rclone processes..." -ForegroundColor Cyan
$Rclone = Get-Process -Name "rclone" -ErrorAction SilentlyContinue
if ($Rclone) { Write-Host "ALERT: Rclone process detected! PID: $($Rclone.Id)" -ForegroundColor Red }
else { Write-Host "No Rclone processes detected." -ForegroundColor Green }


---

# Incident Response Priorities

1.  **T-Minus Detection Checklist:**
    *   Check VPN and remote access logs (specifically ScreenConnect) for successful logins from unfamiliar GeoIPs or impossible travel intervals.
    *   Hunt for `vssadmin.exe` execution or `wbadmin.exe` usage to delete system state backups.
    *   Look for massive file write operations (GBs of data) to folders like `C:\Windows\Temp` or `AppData\Local\Temp` (data staging).

2.  **Critical Assets (Prioritize for Exfil Review):**
    *   **Healthcare:** Patient PHI (EMR databases), billing records.
    *   **Manufacturing:** CAD designs, intellectual property, supply chain manifests.
    *   **Business Services:** Client financial data, HR records, tax documents.

3.  **Containment Actions (Ordered by Urgency):**
    *   **Immediate:** Isolate systems showing signs of Rclone or ScreenConnect exploitation. Disconnect VPN concentrators if infection is suspected.
    *   **High:** Force-reset passwords for all service accounts used by remote management software (ScreenConnect, NinjaOne, etc.).
    *   **Medium:** Suspend domain admin accounts and review Kerberos ticket granting events (Golden Ticket checks).

---

# Hardening Recommendations

**Immediate (24 Hours):**
*   **Patch CVE-2024-1708:** Apply the ConnectWise ScreenConnect patch immediately or block external access to the web interface at the perimeter firewall.
*   **Patch CVE-2026-48027:** Update Nx Console to the latest patched version. Verify software integrity as this CVE involves embedded malicious code.
*   **Disable RDP:** Ensure RDP is blocked from the internet and strictly enforced with MFA for internal access.

**Short-term (2 Weeks):**
*   **Network Segmentation:** Separate IT and OT networks (specifically for Manufacturing victims) to prevent lateral movement from the corporate domain to production lines.
*   **Implement CASB:** Monitor cloud storage uploads to detect unauthorized exfiltration to services like MEGA or pCloud.

---