QILIN Ransomware: Financial Sector & Critical Infrastructure Under Siege — Detection Rules & IOCs

---
title: Potential ConnectWise ScreenConnect Authentication Bypass
cve: 2024-1708
date: 2026/06/22
status: experimental
description: Detects potential authentication bypass or exploitation attempts on ConnectWise ScreenConnect resulting in suspicious process execution.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\\ConnectwiseControl.Client.exe'
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use via ScreenConnect
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
    - ransomware.qilin
---
title: Check Point Security Gateway IKEv1 Anomaly Indicator
cve: 2026-50751
date: 2026/06/22
status: experimental
description: Detects suspicious network activity or process execution patterns associated with post-exploitation activity following Check Point VPN exploitation.
references:
    - https://cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_src:
        Image|endswith: '\\vpn.exe'
    selection_dst:
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
    filter_legit:
        User|contains: 'SYSTEM' # Contextual filter, adjust to env
    condition: selection_src and selection_dst
falsepositives:
    - Administrative VPN troubleshooting
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.50751
    - ransomware.qilin
---
title: Qilin Ransomware Rust Process Pattern
date: 2026/06/22
status: experimental
description: Detects the execution of Qilin ransomware binaries (Rust-based) characterized by specific command line arguments often used by the group.
references:
    - Internal Research
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '.exe'
        Company|contains:
            - 'None' # Rust binaries often lack metadata
    selection_cli:
        CommandLine|contains:
            - '-p'
            - '--path'
            - '--threads'
    condition: selection_img and selection_cli
falsepositives:
    - Legitimate legacy utilities or development tools
level: critical
tags:
    - attack.impact
    - attack.t1486
    - malware.ransomware.qilin

// Hunt for lateral movement and potential ransomware staging
let TimeFrame = ago(7d);
DeviceProcessEvents
| where Timestamp > TimeFrame
| where InitiatingProcessFileName in (\"psexec.exe\", \"psexec64.exe\", \"wmic.exe\") 
   or ProcessCommandLine contains \"New-PSDrive\" 
   or ProcessCommandLine contains \"-ExecutionPolicy Bypass\"
// Filter for high risk command lines often used in staging
| where ProcessCommandLine has \"\\\\\" or ProcessCommandLine has \"-f\"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

# Qilin Rapid Response Audit Script
Write-Host \"[*] Starting Qilin Ransomware Pre-Encryption Audit...\" -ForegroundColor Cyan

# 1. Check for exposed RDP (Reg Check)
$fDenyTSConnections = (Get-ItemProperty \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\").fDenyTSConnections
if ($fDenyTSConnections -eq 0) {
    Write-Host \"[!] ALERT: RDP is ENABLED. Consider disabling or restricting via firewall.\" -ForegroundColor Red
} else {
    Write-Host \"[+] PASS: RDP is disabled.\" -ForegroundColor Green
}

# 2. Enumerate Scheduled Tasks created in last 7 days (Persistence)
$tasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}
if ($tasks) {
    Write-Host \"[!] ALERT: Suspicious Scheduled Tasks created in last 7 days:\" -ForegroundColor Yellow
    $tasks | Select-Object TaskName, Date, Author
} else {
    Write-Host \"[+] PASS: No new scheduled tasks detected in last 7 days.\" -ForegroundColor Green
}

# 3. Check Volume Shadow Copy Status (Staging/Destruction)
try {
    $vss = vssadmin list shadows
    if ($vss -match \"No shadow copies found\") {
        Write-Host \"[!] WARNING: No Volume Shadow Copies found. This may indicate prior deletion.\" -ForegroundColor Red
    } else {
        Write-Host \"[+] INFO: Volume Shadow Copies exist.\" -ForegroundColor Green
    }
} catch {
    Write-Host \"[!] ERROR: Could not query VSS.\" -ForegroundColor Red
}

Write-Host \"[*] Audit Complete.\" -ForegroundColor Cyan


---