QILIN Ransomware Gang: 14 New Victims Posted — Sector Targeting Analysis & Detection Rules

---
title: Potential Qilin Ransomware Activity - Suspicious PowerShell Commands
id: 4e3a2c1f-8d4b-4a9e-9c6d-7b5a8e3f6d2c
status: experimental
description: Detects suspicious PowerShell commands potentially associated with Qilin ransomware operations, including credential dumping and lateral movement
references:
    - Internal Qilin Analysis
author: Security Arsenal Research
date: 2026/06/02
tags:
    - attack.credential_access
    - attack.lateral_movement
    - attack.execution
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4103 or 4104
    credential_keywords:
        ContextInfo|contains:
            - 'Mimikatz'
            - 'Invoke-Mimikatz'
            - 'DumpCreds'
            - 'Get-ComputerInfo'
    lateral_keywords:
        ContextInfo|contains:
            - 'New-PSDrive'
            - 'Copy-Item'
            - 'Invoke-WmiMethod'
            - 'Invoke-Command'
    condition: selection and (credential_keywords or lateral_keywords)
falsepositives:
    - Legitimate administrative activities
level: high

---
title: Potential Qilin Ransomware Activity - Unusual RDP Connections
id: 7f9e3c2a-6d5b-4e8f-9a7c-3b2d8e4f5a6c
status: experimental
description: Detects suspicious Remote Desktop Protocol connections potentially associated with Qilin ransomware lateral movement
references:
    - Internal Qilin Analysis
author: Security Arsenal Research
date: 2026/06/02
tags:
    - attack.lateral_movement
    - attack.initial_access
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
        LogonType|re: '^(3|8|10)$'
    filter_admin:
        TargetUserName|re: '(admin|root|administrator)'
    filter_suspicious_source:
        IpAddress|notstartswith: '192.168.'
        IpAddress|notstartswith: '10.'
        IpAddress|notstartswith: '172.16.'
    filter_time:
        Timestamp:
    condition: selection and filter_admin and filter_suspicious_source
falsepositives:
    - Legitimate remote administration from non-corporate networks
level: high

---
title: Potential Qilin Ransomware Activity - Data Exfiltration Indicators
id: 2d8e4f3b-7c6a-5e9f-0a8d-4c3e9f5a6b7d
status: experimental
description: Detects signs of data exfiltration commonly seen in Qilin ransomware operations
references:
    - Internal Qilin Analysis
author: Security Arsenal Research
date: 2026/06/02
tags:
    - attack.exfiltration
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
    filter_suspicious_tools:
        Image|contains:
            - 'rar.exe'
            - 'winrar.exe'
            - '7z.exe'
            - 'zip.exe'
            - 'powershell.exe'
    filter_archiving_keywords:
        CommandLine|contains:
            - '-a'
            - 'archive'
            - 'compress'
    filter_exfil_keywords:
        CommandLine|contains:
            - '\\\\'
            - 'http'
            - 'ftp'
    condition: selection and filter_suspicious_tools and filter_archiving_keywords and filter_exfil_keywords
falsepositives:
    - Legitimate system administration tasks
level: high

// Qilin Ransomware - Lateral Movement and Staging Indicators
// Hunt for suspicious activities associated with Qilin operations
let TimeFrame = ago(7d);
let SuspiciousProcesses = dynamic(["powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "rundll32.exe"]);
let SuspiciousParentProcesses = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "mshta.exe", "regsvr32.exe"]);

// Find suspicious process execution chains
DeviceProcessEvents
| where Timestamp >= TimeFrame
| where InitiatingProcessFileName in~ (SuspiciousParentProcesses) and FileName in~ (SuspiciousProcesses)
| extend ProcessCommandLine = tostring(ProcessCommandLine)
| where ProcessCommandLine contains any("invoke-expression", "downloadstring", "iex", "net.user", "net share", "whoami", "net localgroup")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by Timestamp desc
| limit 100

# Qilin Ransomware - Quick Response Hardening Script
# Run this script on potentially compromised systems to gather evidence and apply immediate hardening

function Get-QilinIndicators {
    param(
        [int]$DaysToCheck = 7
    )
    
    $results = @()
    $cutoffDate = (Get-Date).AddDays(-$DaysToCheck)
    
    # Check for recently created scheduled tasks
    Write-Host "Checking for recently created scheduled tasks..." -ForegroundColor Cyan
    $scheduledTasks = Get-ScheduledTask | Where-Object { $_.Date -gt $cutoffDate } | 
                     Select-Object TaskName, Date, Author, Description | 
                     Where-Object { $_.Author -notlike "*$env:COMPUTERNAME*" }
    
    if ($scheduledTasks) {
        $results += "Found $($scheduledTasks.Count) recently created scheduled tasks:"
        $results += $scheduledTasks | Format-Table | Out-String
    }
    
    # Check for modified Volume Shadow Copies
    Write-Host "Checking for modified Volume Shadow Copies..." -ForegroundColor Cyan
    $shadowCopies = vssadmin list shadows 2>$null | Where-Object { $_ -match "Shadow Copy Volume" }
    
    if ($shadowCopies) {
        $results += "Found Volume Shadow Copies:"
        $results += $shadowCopies
    }
    
    # Check for recently added users
    Write-Host "Checking for recently added users..." -ForegroundColor Cyan
    $newUsers = Get-LocalUser | Where-Object { $_.LastLogon -gt $cutoffDate -or $_.PasswordLastSet -gt $cutoffDate } | 
                Where-Object { $_.PrincipalSource -eq "Local" }
    
    if ($newUsers) {
        $results += "Found recently modified local users:"
        $results += $newUsers | Format-Table | Out-String
    }
    
    # Check for PowerShell event logs with suspicious commands
    Write-Host "Checking for suspicious PowerShell commands..." -ForegroundColor Cyan
    $suspiciousCommands = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; StartTime=$cutoffDate; Id=4104} -ErrorAction SilentlyContinue | 
                         Where-Object { $_.Message -match "(Invoke-Expression|DownloadString|IEX)" } |
                         Select-Object TimeCreated, Message
    
    if ($suspiciousCommands) {
        $results += "Found $($suspiciousCommands.Count) suspicious PowerShell commands:"
        $results += $suspiciousCommands | Format-List | Out-String
    }
    
    return $results
}

# Apply immediate hardening measures
function Invoke-ImmediateHardening {
    Write-Host "Applying immediate hardening measures..." -ForegroundColor Yellow
    
    # Disable RDP if not needed
    Write-Host "Checking RDP status..." -ForegroundColor Cyan
    $rdpStatus = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
    
    if ($rdpStatus -eq 0) {
        Write-Host "WARNING: RDP is enabled. Consider disabling it if not required." -ForegroundColor Red
        # Uncomment below to disable RDP
        # Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1
        # Write-Host "RDP has been disabled." -ForegroundColor Green
    }
    
    # Check for SMBv1
    Write-Host "Checking SMBv1 status..." -ForegroundColor Cyan
    $smbv1 = Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
    
    if ($smbv1.EnableSMB1Protocol -eq $true) {
        Write-Host "WARNING: SMBv1 is enabled. Disabling..." -ForegroundColor Red
        Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
        Write-Host "SMBv1 has been disabled." -ForegroundColor Green
    }
    
    # Enable Windows Firewall if not enabled
    Write-Host "Checking Windows Firewall status..." -ForegroundColor Cyan
    $firewallProfile = Get-NetFirewallProfile | Where-Object { $_.Enabled -eq $false }
    
    if ($firewallProfile) {
        Write-Host "WARNING: Windows Firewall profiles are disabled. Enabling..." -ForegroundColor Red
        $firewallProfile | Set-NetFirewallProfile -Enabled True
        Write-Host "Windows Firewall has been enabled for all profiles." -ForegroundColor Green
    }
}

# Main execution
Write-Host "Starting Qilin Ransomware Response Script..." -ForegroundColor Green
Write-Host "Gathering indicators of compromise..." -ForegroundColor Yellow
$indicators = Get-QilinIndicators -DaysToCheck 7

Write-Host "`nIndicator Results:" -ForegroundColor Green
$indicators | ForEach-Object { Write-Host $_ -ForegroundColor White }

Write-Host "`n" -ForegroundColor White
Invoke-ImmediateHardening

Write-Host "`nScript execution completed." -ForegroundColor Green
Write-Host "Please review the results and escalate to your security team if indicators are found." -ForegroundColor Yellow