QILIN Ransomware: Aggressive Surge in Manufacturing & Healthcare — Critical Vulnerabilities Exploited

---
title: Potential CVE-2024-1708 ConnectWise ScreenConnect Exploitation
id: 8c30a3a6-7b6c-4c3e-9e1f-5d7f1a9b0c2d
description: Detects potential exploitation of ConnectWise ScreenConnect Authentication Bypass and Path Traversal vulnerabilities via suspicious process chains or webshell creation.
status: experimental
date: 2026/05/17
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - cve.2024.1708
    - detection.emerging_threats
    - ransomware.qilin
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Web Server.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
    filter_legit:
        CommandLine|contains:
            - 'ScreenConnect.ClientInstaller'
            - 'ConnectWiseControl'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative scripts run by ScreenConnect administrators
level: high

---
title: Suspicious SmarterMail Web Shell Activity
id: 9d41b4b7-8c5d-4d0f-0f2g-6e8g2b0c1d3e
description: Detects potential webshell upload or exploitation activity targeting SmarterMail servers, indicative of CVE-2025-52691 or CVE-2026-23760 exploitation.
status: experimental
date: 2026/05/17
author: Security Arsenal
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
tags:
    - cve.2025.52691
    - cve.2026.23760
    - attack.web_shell
    - ransomware.qilin
logsource:
    category: web
    product: iis
detection:
    selection_uri:
        cs-uri-query|contains:
            - 'asp.net\'
            - 'SetupWizard.aspx'
            - '..%2F'
    selection_method:
        cs-method: POST
    selection_ext:
        cs-uri-stem|endswith:
            - '.aspx'
            - '.ashx'
    condition: all of selection_*
falsepositives:
    - Unknown
level: critical

---
title: Ransomware Pre-Encryption Activity - Qilin Patterns
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects patterns often observed prior to Qilin encryption, including Shadow Copy deletion and service stopping via PowerShell or WMIC.
status: experimental
date: 2026/05/17
author: Security Arsenal
tags:
    - attack.impact
    - ransomware.qilin
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        CommandLine|contains:
            - 'vssadmin delete shadows'
            - 'wbadmin delete catalog'
    selection_wmic:
        CommandLine|contains:
            - 'shadowcopy delete'
    selection_stop:
        CommandLine|contains:
            - 'Stop-Service'
            - 'net stop'
    filter_exclude:
        Image|endswith:
            - '\backup_exec.exe'
            - '\veeam.exe'
    condition: 1 of selection_* and not filter_exclude
falsepositives:
    - Legitimate system backup operations
level: high

// Hunt for Qilin lateral movement and staging
// Looks for PsExec/WMI usage and large file transfers common in their playbook
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ ("psexec.exe", "psexec64.exe", "wmic.exe", "powershell.exe")
| where ProcessCommandLine has any(@("-accepteula", "process call create", "Invoke-Command", "New-Object System.Net.WebClient"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(TimeFrame)
    | where RemotePort in (443, 445, 3389) or ActionType == "ConnectionSuccess"
    | summarize SentBytes=sum(TotalBytesSent), ReceivedBytes=sum(TotalBytesReceived) by DeviceName, Timestamp
    | where SentBytes > 50000000 // > 50MB sent indicates potential exfil
) on DeviceName, Timestamp
| distinct Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, SentBytes
| sort by Timestamp desc

<#
.SYNOPSIS
    Qilin Ransomware Response Hardening & Hunt Script
.DESCRIPTION
    Checks for recent Shadow Copy deletions, unusual scheduled tasks, 
    and enumerates exposed RDP/ScreenConnect services.
#>

Write-Host "[*] Starting Qilin Response Checks..." -ForegroundColor Cyan

# 1. Check for recent Shadow Copy deletion events (Event ID 4663 with VSS access)
Write-Host "[+] Checking for Shadow Copy Deletion (Last 24h)..." -ForegroundColor Yellow
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
              Where-Object {$_.Message -match "vssadmin" -or $_.Message -match "Shadow Copy"};
if ($VssEvents) { $VssEvents | Select-Object TimeCreated, Message | Format-Table -AutoSize } 
else { Write-Host "No Shadow Copy deletion events found." -ForegroundColor Green }

# 2. Hunt for recently created Scheduled Tasks (Persistence mechanism)
Write-Host "[+] Checking for Scheduled Tasks created in last 7 days..." -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) };
if ($RecentTasks) { $RecentTasks | Select-Object TaskName, Date, Author, Actions | Format-Table -AutoSize }
else { Write-Host "No recent suspicious tasks found." -ForegroundColor Green }

# 3. Check for ScreenConnect Service Status (CVE-2024-1708)
Write-Host "[+] Checking for ConnectWise ScreenConnect Services..." -ForegroundColor Yellow
$ScreenConnect = Get-Service | Where-Object { $_.DisplayName -like "*ScreenConnect*" -or $_.DisplayName -like "*Control*" };
if ($ScreenConnect) {
    Write-Host "WARNING: ScreenConnect service detected. Verify patch levels immediately for CVE-2024-1708." -ForegroundColor Red
    $ScreenConnect | Select-Object Name, DisplayName, Status, StartType
}

Write-Host "[*] Check complete." -ForegroundColor Cyan


---