QILIN Ransomware Campaign: Surge in Construction & Financial Sector Attacks

---
title: Potential Ransomware Initial Access via Check Point Security Gateway
id: b2c4f6a1-4e5d-4b5a-9c8d-7e6f5a4b3c2d
description: Detects potential exploitation of CVE-2026-50751 involving IKEv1 anomalies or unusual VPN authentication bursts associated with Qilin initial access.
author: Security Arsenal
date: 2026/06/23
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    product: checkpoint
detection:
    selection:
        service|contains: 'IKE'
        action|contains: 'accept'
        vpn|contains: 'ikev1'
    condition: selection | count() > 50
falsepositives:
    - Legitimate high-volume VPN reconnections
level: high
tags:
    - attack.initial_access
    - cve.2026.50751
---
title: Suspicious ConnectWise ScreenConnect Path Traversal Activity
id: c3d5e7b2-5f6e-5c6b-0d9e-8f7a6b5c4d3e
description: Detects path traversal indicators associated with CVE-2024-1708 exploitation on ScreenConnect servers, a known Qilin vector.
author: Security Arsenal
date: 2026/06/23
logsource:
    product: web server
    service: iis
detection:
    selection_uri:
        cs-uri-query|contains:
            - '../'
            - '%2e%2e'
            - 'setupWizard'
    selection_status:
        sc-status:
            - 200
            - 500
    condition: all of selection*
falsepositives:
    - Rare scanning noise
level: critical
tags:
    - attack.initial_access
    - cve.2024.1708
---
title: Qilin Ransomware Pre-Encryption PowerShell Activity
id: d4e6f8c3-6g7f-6d7c-1e0f-0g8b7c6d5e4f
description: Detects PowerShell commands used to clear logs or stop services, often observed in Qilin playbook prior to encryption.
author: Security Arsenal
date: 2026/06/23
logsource:
    product: windows
    service: security
detection:
    selection_process:
        NewProcessName|endswith:
            - '\\powershell.exe'
            - '\\pwsh.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'Clear-EventLog'
            - 'wevtutil cl'
            - 'Remove-Item -Recurse -Force'
            - 'vssadmin delete shadows'
    condition: all of selection*
falsepositives:
    - System administration scripts
level: high
tags:
    - attack.execution
    - attack.defense_evasion


kql
// Hunt for lateral movement and data staging patterns associated with Qilin
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ ("powershell.exe", "cmd.exe", "wmi.exe", "psexec.exe", "psexec64.exe")
| where ProcessCommandLine has any ("Invoke-Command", "New-PSDrive", "net use", "copy", "robocopy")
| summarize StartTime=min(Timestamp), EndTime=max(Timestamp), ProcessCount=count() by DeviceName, AccountName, FileName, ProcessCommandLine
| where ProcessCount > 5
| extend Severity = "High"


powershell
# Rapid Response: Hunt for Qilin Indicators of Compromise
# Check for unusual scheduled tasks and recent large file modifications

Write-Host "Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } | Select-Object TaskName, TaskPath, Date, Author

Write-Host "`nChecking for recently modified Volume Shadow Copies (VSS) deletions..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; StartTime=(Get-Date).AddHours(-24); Id=12343} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Message

Write-Host "`nEnumerating non-system accounts with RDP access..." -ForegroundColor Cyan
net localgroup "Remote Desktop Users" | Where-Object { $_ -notmatch "^(The command completed successfully|$)" -and $_ -ne "" }