QILIN Ransomware: Aggressive Surge in Manufacturing & Public Sector — CVE Exploitation & Detection Rules

---
title: Potential SmarterMail Authentication Bypass (CVE-2026-23760)
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
description: Detects potential authentication bypass attempts on SmarterMail servers via alternate paths or unusual user agents associated with CVE-2026-23760 exploitation.
status: experimental
date: 2026/04/23
author: Security Arsenal Research
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: webserver
    service: iis, apache
    definition: 'Assumes access to web server access logs'
detection:
    selection:
        c-uri|contains: '/Services/'
        c-uri|contains: 'MailService.asmx'
    filter_legit:
        cs-user-agent|contains: 'SmarterTools'
    filter_status:
        sc-status: 401
    condition: selection and not filter_legit and not filter_status
falsepositives:
    - Legitimate API testing by administrators
level: critical
---
title: Microsoft Exchange Deserialization Exploit (CVE-2023-21529)
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects suspicious deserialization patterns or specific endpoint access related to Microsoft Exchange Server CVE-2023-21529 exploitation.
status: experimental
date: 2026/04/23
author: Security Arsenal Research
logsource:
    product: windows
    service: security
    definition: 'Requires advanced auditing or EDR telemetry'
detection:
    selection:
        EventID: 5140 or 5145
        ShareName|contains: 'Exchange'
    selection_exploit:
        RelativeTargetName|contains: 'rpc'
    condition: selection and selection_exploit
falsepositives:
    - High
level: high
---
title: Cobalt Strike Beacon Process Injection (Qilin Affiliate)
id: 9f8e7d6c-5b4a-3f2e-1d0c-9b8a7f6e5d4c
description: Detects typical Cobalt Strike process injection patterns often used by Qilin affiliates for lateral movement and privilege escalation.
status: experimental
date: 2026/04/23
author: Security Arsenal Research
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\svchost.exe'
            - '\wmiprvse.exe'
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
        CommandLine|contains:
            - 'reflectivepicker'
            - 'http://127.0.0.1:'
    condition: selection
falsepositives:
    - Low
level: critical

// Hunt for Qilin lateral movement and data staging
// Looks for high volume data transfer and unusual SMB access
let TimeFrame = 1d;
let FileExtensions = dynamic(['.pst', '.ost', '.bak', '.sql', '.db', '.mdf', '.zip', '.7z', '.rar']);
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ ('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe')
| where ProcessCommandLine has any('Invoke-Acl', 'icacls', 'robocopy', 'rar', '7z')
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(TimeFrame)
    | where FileName endswith FileExtensions
    | where InitiatingProcessFileName in~ ('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe')
    | where ActionType == 'FileCreated'
) on DeviceId
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, ProcessCommandLine, SHA256
| distinct Timestamp, DeviceName, FileName, ProcessCommandLine

# Qilin TTP Hardening & Discovery Script
# Must be run as Administrator

Write-Host "[*] Starting Qilin Response Hardening..." -ForegroundColor Cyan

# 1. Check for recently created suspicious scheduled tasks
Write-Host "[+] Checking for Scheduled Tasks created in last 7 days..." -ForegroundColor Yellow
$DateCutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Date -gt $DateCutoff } | Select-Object TaskName, Author, Date, Action | Format-Table -AutoSize

# 2. Enumerate Volume Shadow Copies (Check for deletion attempts)
Write-Host "[+] Checking Volume Shadow Copy Status..." -ForegroundColor Yellow
Get-WmiObject Win32_ShadowCopy | Select-Object ID, VolumeName, InstallDate, ClientAccessible | Format-Table -AutoSize

# 3. Audit RDP Users
Write-Host "[+] Auditing Local RDP Enabled Users..." -ForegroundColor Yellow
Get-LocalUser | Where-Object { $_.Enabled -eq $true } | Select-Object Name, SID, LastLogon

# 4. Disable Guest Account (if enabled)
Write-Host "[+] Hardening: Disabling Guest Account..." -ForegroundColor Yellow
Disable-LocalUser -Name "Guest"

# 5. Check for common Qilin persistence paths
Write-Host "[+] Checking common persistence paths..." -ForegroundColor Yellow
$Paths = @("C:\ProgramData\", "C:\Windows\Temp\", "C:\Users\Public\")
ForEach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Filter *.exe -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.CreationTime -gt $DateCutoff } | 
        Select-Object FullName, CreationTime, Length
    }
}

Write-Host "[*] Script Complete. Review output." -ForegroundColor Green