QILIN Ransomware: Cross-Sector Surge & Critical Infrastructure Targeting — Detection Engineering Brief

title: Potential ConnectWise ScreenConnect CVE-2024-1708 Exploitation
id: 5a4b32c7-8d3e-4b1a-9c1f-3d9e5a6b7c8d
description: Detects potential exploitation of ConnectWise ScreenConnect path traversal vulnerability via suspicious web session creation paths.
status: experimental
date: 2026/05/20
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '/Bin/ScreenConnect.ashx'
            - '/Host.ashx'
        c-uri-query|contains:
            - '..%2F'
            - '..\\'
    condition: selection
falsepositives:
    - Unknown
level: critical

tags:
    - attack.initial_access
    - cve.2024.1708
    - detection.emerging_threats
---
title: Cobalt Strike Beacon Process Injection
id: b2c44d1e-9e5f-4a2b-8c3d-1e0f5a6b7c8d
description: Detects suspicious process injection patterns often used by Qilin operators leveraging Cobalt Strike beacons (cross-process allocation).
status: experimental
date: 2026/05/20
author: Security Arsenal Research
logsource:
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'crossproc'
            - 'fork&run'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
    filter:
        ParentImage|contains:
            - '\Program Files'
            - '\Windows System32'
    condition: selection and not filter
falsepositives:
    - Legitimate administration tools
level: high
tags:
    - attack.execution
    - attack.t1055
---
title: Qilin Ransomware Pre-Encryption Shadow Copy Deletion
id: c1d33e0f-8d4e-4b1a-9c1f-3d9e5a6b7c8d
description: Detects commands used to delete Volume Shadow Copies via vssadmin or diskshadow, a common precursor to Qilin encryption.
status: experimental
date: 2026/05/20
author: Security Arsenal Research
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\vssadmin.exe'
            - '\diskshadow.exe'
            - '\wbadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'delete all'
            - 'resize shadowstorage'
    condition: selection
falsepositives:
    - System administrator maintenance
level: critical
tags:
    - attack.impact
    - attack.t1490

// Hunt for potential Qilin lateral movement and staging
// Focuses on named pipes common in Cobalt Strike and SMB lateral movement
DeviceProcessEvents 
| where Timestamp >= ago(7d)
| where (FileName in ("powershell.exe", "cmd.exe", "rundll32.exe") or InitiatingProcessFileName in ("powershell.exe", "cmd.exe"))
| extend ProcessCmdLine = tostring(ProcessCommandLine)
| where ProcessCmdLine contains "\\.\pipe\" or 
       ProcessCmdLine contains "Invoke-WebRequest" or 
       ProcessCmdLine contains "DownloadString" or
       ProcessCmdLine contains "-enc " 
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

<#
.SYNOPSIS
    Qilin Ransomware Rapid Response Script
.DESCRIPTION
    Checks for indicators of Qilin pre-encryption activity: VSS tampering, suspicious scheduled tasks, and anomalous SMB connections.
#>

Write-Host "[*] Starting Qilin Ransomware Response Checks..." -ForegroundColor Cyan

# 1. Check for recent Volume Shadow Copy deletions
Write-Host "[+] Checking Event Logs for VSS Deletion (Event ID 25)..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='VSS'; ID=25; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue
if ($vssEvents) { $vssEvents | Select-Object TimeCreated, Message | Format-List } 
else { Write-Host "    No VSS deletion events found in last 24h." -ForegroundColor Green }

# 2. Hunt for Suspicious Scheduled Tasks created in last 48 hours
Write-Host "[+] Enumerating Scheduled Tasks created/modified in last 48h..." -ForegroundColor Yellow
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddHours(-48) }
if ($suspiciousTasks) { $suspiciousTasks | Select-Object TaskName, Date, Author, Actions | Format-Table } 
else { Write-Host "    No recent tasks found." -ForegroundColor Green }

# 3. Check for Hidden Users (Common persistence mechanism)
Write-Host "[+] Checking for hidden users (ending with $)..." -ForegroundColor Yellow
$hiddenUsers = Get-WmiObject -Class Win32_UserAccount | Where-Object { $_.Name -match '\$$' }
if ($hiddenUsers) { Write-Host "    WARNING: Hidden users detected:" -ForegroundColor Red; $hiddenUsers | Select-Object Name, SID } 
else { Write-Host "    No hidden users found." -ForegroundColor Green }

Write-Host "[*] Scan complete." -ForegroundColor Cyan