QILIN Ransomware Gang: 15 New Victims Posted — Global Multi-Sector Campaign Targets Manufacturing & Business Services

---
title: QILIN Ransomware Volume Shadow Copy Deletion - Pre-Encryption Indicator
id: 9c1b2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: >
    Detects Volume Shadow Copy deletion commands consistent with QILIN ransomware
    pre-encryption preparation. QILIN affiliates routinely delete VSS backups,
    disable recovery options, and clear backup catalogs prior to detonating the
    encryptor to eliminate recovery without paying ransom.
author: Security Arsenal Threat Intelligence
date: 2026/06/30
references:
    - https://securityarsenal.com/darkside
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    category: process_creation
detection:
    selection_vssadmin:
        Image|endswith: '\\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wmic_shadow:
        Image|endswith: '\\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_powershell_vss:
        Image|endswith:
            - '\\powershell.exe'
            - '\\pwsh.exe'
        CommandLine|contains:
            - 'Win32_ShadowCopy'
            - 'Delete()'
    selection_wbadmin:
        Image|endswith: '\\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'bootstatuspolicy ignoreallfailures'
    condition: selection_vssadmin or selection_wmic_shadow or selection_powershell_vss or selection_wbadmin or selection_bcdedit
falsepositives:
    - Legitimate backup maintenance operations requiring change control verification
    - System recovery troubleshooting by authorized administrators
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1491
    - ransomware
    - group.qilin

---
title: QILIN Lateral Movement via PsExec WMI and Cobalt Strike Beacon Patterns
id: a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: >
    Detects lateral movement techniques consistent with QILIN affiliate tooling.
    QILIN affiliates use PsExec and WMI for remote execution alongside Cobalt
    Strike beacons for command and control. This rule covers common process
    execution patterns observed in QILIN intrusions including beacon-spawned
    shells and remote service creation.
author: Security Arsenal Threat Intelligence
date: 2026/06/30
references:
    - https://securityarsenal.com/darkside
logsource:
    product: windows
    category: process_creation
detection:
    selection_psexec:
        Image|endswith:
            - '\\psexec.exe'
            - '\\psexec64.exe'
            - '\\psexesvc.exe'
    selection_wmi_remote:
        Image|endswith: '\\wmic.exe'
        CommandLine|contains:
            - 'process call create'
            - '/node:'
    selection_cs_rundll32_beacon:
        Image|endswith: '\
undll32.exe'
        CommandLine|re: '.*#[a-zA-Z0-9]{4,}.*|.*\\.dll.*'
        ParentImage|endswith:
            - '\\services.exe'
            - '\\svchost.exe'
    selection_cs_spawned_shell:
        ParentImage|endswith:
            - '\
undll32.exe'
            - '\\dllhost.exe'
            - '\\wscript.exe'
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\pwsh.exe'
        CommandLine|contains:
            - '-nop'
            - '-enc'
            - '-ExecutionPolicy Bypass'
            - '/c '
    selection_cs_smb_lateral:
        Image|endswith: '\\cmd.exe'
        CommandLine|re: '.*\\\\\[0-9]{1,3}\\\.*|.*\\\\\[a-zA-Z0-9-]+\\\.*cmd\\.exe.*'
    selection_remote_service_create:
        Image|endswith: '\\sc.exe'
        CommandLine|contains|all:
            - '\\'
            - 'create'
    filter_windows_native:
        ParentImage|startswith:
            - 'C:\\Windows\\System32\'
            - 'C:\\Windows\\SysWOW64\'
        Image|startswith:
            - 'C:\\Windows\\System32\'
            - 'C:\\Windows\\SysWOW64\'
    condition: (selection_psexec or selection_wmi_remote or selection_cs_rundll32_beacon or selection_cs_spawned_shell or selection_cs_smb_lateral or selection_remote_service_create) and not filter_windows_native
falsepositives:
    - Legitimate remote administration tools requiring verification against approved inventory
    - SCCM or similar enterprise management platform activity
level: high
tags:
    - attack.lateral_movement
    - attack.t1021
    - attack.t1021.002
    - attack.t1047
    - attack.t1055
    - attack.t1059
    - group.qilin

---
title: QILIN Data Staging and Exfiltration Tool Execution
id: d4e5f6a7-b8c9-0d1e-2f3a-4b5c6d7e8f9a
status: experimental
description: >
    Detects execution of data exfiltration and staging tools commonly used by
    QILIN affiliates prior to encryption detonation. QILIN affiliates have been
    observed using rclone, WinSCP, MEGAsync, FileZilla, and 7-Zip for data
    staging and exfiltration to cloud storage providers before deploying
    encryptors. Detection at this stage provides the last opportunity for
    intervention before irreversible encryption.
author: Security Arsenal Threat Intelligence
date: 2026/06/30
references:
    - https://securityarsenal.com/darkside
logsource:
    product: windows
    category: process_creation
detection:
    selection_exfil_tools:
        Image|endswith:
            - '\
clone.exe'
            - '\\winscp.exe'
            - '\\winscp.com'
            - '\\megasync.exe'
            - '\filezilla.exe'
            - '\ftp.exe'
            - '\\psftp.exe'
    selection_7zip_stage:
        Image|endswith:
            - '\\7z.exe'
            - '\\7za.exe'
            - '\\7zr.exe'
        CommandLine|contains|all:
            - ' a '
            - '-p'
    selection_rclone_config:
        Image|endswith: '\
clone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'move'
            - 'remote'
            - ':s3,'
            - ':mega,'
            - ':gdrive,'
            - ':sftp,'
    selection_powershell_exfil:
        Image|endswith:
            - '\\powershell.exe'
            - '\\pwsh.exe'
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'System.Net.WebClient'
            - 'UploadFile'
            - 'DownloadFile'
    condition: selection_exfil_tools or selection_7zip_stage or selection_rclone_config or selection_powershell_exfil
falsepositives:
    - Legitimate file transfer operations requiring verification against approved tool list
    - Backup software using 7-Zip compression
level: high
tags:
    - attack.exfiltration
    - attack.t1567
    - attack.t1567.001
    - attack.t1567.002
    - attack.t1074
    - attack.t1074.001
    - group.qilin

// QILIN Pre-Ransomware Activity Hunt — 14 Day Lookback
// Hunts for VSS deletion, lateral movement, data staging, and persistence indicators
let qilinTimeWindow = 14d;
// VSS deletion and backup destruction indicators
let vssDeletion = DeviceProcessEvents
| where Timestamp > ago(qilinTimeWindow)\| where ProcessCommandLine has_any ('vssadmin delete shadows', 'wmic shadowcopy delete', 'Win32_ShadowCopy', 'wbadmin delete catalog', 'bcdedit')
| extend DetectionCategory = 'VSS_Deletion', RiskLevel = 'CRITICAL'
| project Timestamp, DeviceName, AccountName, DetectionCategory, RiskLevel, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Lateral movement via PsExec, WMI, and Cobalt Strike patterns
let lateralMovement = DeviceProcessEvents
| where Timestamp > ago(qilinTimeWindow)
| where (FileName in~ ('psexec.exe', 'psexec64.exe', 'psexesvc.exe'))
    or (FileName =~ 'wmic.exe' and ProcessCommandLine has_any ('process call create', '/node:'))
    or (InitiatingProcessFileName =~ 'rundll32.exe' and FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe'))
    or (InitiatingProcessFileName =~ 'dllhost.exe' and FileName in~ ('cmd.exe', 'powershell.exe'))
    or (FileName =~ 'sc.exe' and ProcessCommandLine has 'create' and ProcessCommandLine has '\\')
| extend DetectionCategory = 'Lateral_Movement', RiskLevel = 'HIGH'
| project Timestamp, DeviceName, AccountName, DetectionCategory, RiskLevel, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Data exfiltration and staging tool execution
let exfilTools = DeviceProcessEvents
| where Timestamp > ago(qilinTimeWindow)
| where FileName in~ ('rclone.exe', 'winscp.exe', 'winscp.com', 'megasync.exe', 'filezilla.exe', '7z.exe', '7za.exe')
    or (FileName in~ ('powershell.exe', 'pwsh.exe') and ProcessCommandLine has_any ('Invoke-WebRequest', 'Invoke-RestMethod', 'UploadFile', 'WebClient'))
| extend DetectionCategory = 'Exfiltration_Staging', RiskLevel = 'HIGH'
| project Timestamp, DeviceName, AccountName, DetectionCategory, RiskLevel, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Persistence via scheduled task creation
let persistenceTasks = DeviceProcessEvents
| where Timestamp > ago(qilinTimeWindow)
| where (FileName =~ 'schtasks.exe' and ProcessCommandLine has_any ('/create', '/change'))
    or (ProcessCommandLine has 'Register-ScheduledTask')
| extend DetectionCategory = 'Persistence_ScheduledTask', RiskLevel = 'MEDIUM'
| project Timestamp, DeviceName, AccountName, DetectionCategory, RiskLevel, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Defender exclusion additions — defense evasion
let defenderExclusions = DeviceProcessEvents
| where Timestamp > ago(qilinTimeWindow)
| where ProcessCommandLine has 'Add-MpPreference' and ProcessCommandLine has_any ('-ExclusionPath', '-ExclusionProcess', '-ExclusionExtension')
| extend DetectionCategory = 'Defender_Exclusion', RiskLevel = 'HIGH'
| project Timestamp, DeviceName, AccountName, DetectionCategory, RiskLevel, FileName, ProcessCommandLine, InitiatingProcessFileName;
union vssDeletion, lateralMovement, exfilTools, persistenceTasks, defenderExclusions
| sort by Timestamp desc
| summarize Detections = make_list(pack('Time', Timestamp, 'Device', DeviceName, 'Account', AccountName, 'Category', DetectionCategory, 'Risk', RiskLevel, 'Process', FileName, 'CommandLine', ProcessCommandLine, 'Parent', InitiatingProcessFileName)) by DeviceName
| extend DetectionCount = array_length(Detections)
| where DetectionCount >= 1
| order by DetectionCount desc

<#
.SYNOPSIS
    QILIN Ransomware Rapid Detection & Hardening Sweep
.DESCRIPTION
    Detects indicators of compromise associated with QILIN ransomware pre-encryption
    activity including VSS deletion, lateral movement tools, persistence mechanisms,
    Cobalt Strike named pipes, and data staging. Run as Administrator on Windows
    endpoints — prioritize Domain Controllers, Exchange servers, and VPN gateways.
.AUTHOR
    Security Arsenal Threat Intelligence
.DATE
    2026-06-30
#>

Write-Host \"========================================\" -ForegroundColor Red
Write-Host \" QILIN Ransomware Rapid Detection Sweep\" -ForegroundColor Red
Write-Host \"========================================\" -ForegroundColor Red
Write-Host \"Scan started: $(Get-Date)\" -ForegroundColor Cyan
Write-Host \"\"

# 1. Check RDP Exposure and NLA Status
Write-Host \"[1] Checking RDP Exposure & NLA...\" -ForegroundColor Yellow
$rdpReg = Get-ItemProperty -Path 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server' -Name \"fDenyTSConnections\" -ErrorAction SilentlyContinue
if ($rdpReg -and $rdpReg.fDenyTSConnections -eq 0) {
    Write-Host \"    [!] RDP is ENABLED on this host\" -ForegroundColor Red
    $rdpListener = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
    if ($rdpListener) {
        Write-Host \"    [!] RDP actively listening on port 3389\" -ForegroundColor Red
        $rdpListener | ForEach-Object { Write-Host \"        LocalAddress: $($_.LocalAddress) PID: $($_.OwningProcess)\" -ForegroundColor Red }
    }
    $rdpNLA = Get-ItemProperty -Path 'HKLM:\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name \"UserAuthentication\" -ErrorAction SilentlyContinue
    if ($rdpNLA -and $rdpNLA.UserAuthentication -eq 0) {
        Write-Host \"    [!] Network Level Authentication (NLA) is DISABLED — enable immediately\" -ForegroundColor Red
    } else {
        Write-Host \"    [OK] NLA is enabled\" -ForegroundColor Green
    }
} else {
    Write-Host \"    [OK] RDP is disabled\" -ForegroundColor Green
}

# 2. Enumerate Scheduled Tasks Modified in Last 7 Days (non-Microsoft)
Write-Host \"\"
Write-Host \"[2] Non-Microsoft Scheduled Tasks Modified in Last 7 Days...\" -ForegroundColor Yellow
$allTasks = Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' -and $_.TaskPath -notmatch '\\\Microsoft\\' }
$recentTasks = @()
foreach ($task in $allTasks) {
    $info = Get-ScheduledTaskInfo -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
    $taskXml = [xml](Export-ScheduledTask -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue)
    $regDate = $taskXml.Task.RegistrationInfo.Date
    if ($regDate -and [datetime]$regDate -gt (Get-Date).AddDays(-7)) {
        $recentTasks += [PSCustomObject]@{
            TaskName = $task.TaskName
            Author = $task.Author
            State = $task.State
            RegistrationDate = $regDate
            Actions = ($task.Actions | ForEach-Object { \"$($_.Execute) $($_.Arguments)\" }) -join '; '
        }
    }
}
if ($recentTasks.Count -gt 0) {
    $recentTasks | Format-Table -AutoSize -Wrap
    Write-Host \"    [!] Review these tasks for malicious persistence\" -ForegroundColor Red
} else {
    Write-Host \"    [OK] No recently created non-Microsoft scheduled tasks found\" -ForegroundColor Green
}

# 3. Volume Shadow Copy Status
Write-Host \"\"
Write-Host \"[3] Volume Shadow Copy Status...\" -ForegroundColor Yellow
$vssOutput = vssadmin list shadows 2>$null
if ($LASTEXITCODE -eq 0) {
    if ($vssOutput -match 'No items found') {
        Write-Host \"    [!] NO Volume Shadow Copies exist — verify if expected or if VSS was deleted\" -ForegroundColor Red
    } else {
        $shadowCount = ([regex]::Matches($vssOutput, 'Shadow Copy Volume')).Count
        Write-Host \"    [OK] Found $shadowCount shadow copy volume(s)\" -ForegroundColor Green
        $vssOutput -split \"`n\" | Where-Object { $_ -match 'Creation Time|Shadow Copy Volume' } | ForEach-Object { Write-Host \"      $_\" -ForegroundColor Gray }
    }
} else {
    Write-Host \"    [!] Unable to query VSS status — verify vssadmin access\" -ForegroundColor Yellow
}

# 4. Suspicious Services with Abnormal Execution Paths
Write-Host \"\"
Write-Host \"[4] Suspicious Services...\" -ForegroundColor Yellow
$suspiciousSvcs = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'powershell\\.exe|cmd\\.exe|rundll32\\.exe|wscript\\.exe|cscript\\.exe' -and
    $_.PathName -notmatch 'Windows\\\System32\\\|Windows\\\SysWOW64\\'
}
if ($suspiciousSvcs) {
    $suspiciousSvcs | ForEach-Object {
        Write-Host \"    [!] Service: $($_.Name) | Path: $($_.PathName) | State: $($_.State)\" -ForegroundColor Red
    }
} else {
    Write-Host \"    [OK] No suspicious services detected\" -ForegroundColor Green
}

# 5. Cobalt Strike Named Pipe Detection
Write-Host \"\"
Write-Host \"[5] Cobalt Strike Named Pipe Detection...\" -ForegroundColor Yellow
$csPipePattern = 'postex_|status_|msagent_|MSSE-|spoolss_|searchText_|cafefrica_|powershell_'
$csPipes = Get-ChildItem '\\\.\\pipe\' -ErrorAction SilentlyContinue | Where-Object { $_.Name -match $csPipePattern }
if ($csPipes) {
    $csPipes | ForEach-Object { Write-Host \"    [!] Suspicious Named Pipe: $($_.Name)\" -ForegroundColor Red }
} else {
    Write-Host \"    [OK] No Cobalt Strike named pipes detected\" -ForegroundColor Green
}

# 6. Running Exfiltration Tools
Write-Host \"\"
Write-Host \"[6] Exfiltration Tool Detection...\" -ForegroundColor Yellow
$exfilProcNames = @('rclone', 'winscp', 'megasync', 'filezilla', '7z', '7za')
$runningExfil = Get-Process -ErrorAction SilentlyContinue | Where-Object { $exfilProcNames -contains $_.Name }
if ($runningExfil) {
    $runningExfil | ForEach-Object { Write-Host \"    [!] Running: $($_.Name) (PID: $($_.Id)) — investigate immediately\" -ForegroundColor Red }
} else {
    Write-Host \"    [OK] No known exfiltration tools currently running\" -ForegroundColor Green
}

# 7. Recent Archive Files in Temp Directories (Data Staging)
Write-Host \"\"
Write-Host \"[7] Recent Archive Files in Temp/Public Directories...\" -ForegroundColor Yellow
$stagingPaths = @('C:\\Users\\Public', 'C:\\Windows\\Temp', 'C:\\Temp', $env:TEMP)
$archiveExts = @('.zip', '.7z', '.rar', '.tar', '.gz')
$recentArchives = foreach ($path in $stagingPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $archiveExts -contains $_.Extension }
    }
}
if ($recentArchives) {
    $recentArchives | ForEach-Object {
        $sizeMB = [math]::Round($_.Length / 1MB, 2)
        Write-Host \"    [!] Recent archive: $($_.FullName) | Size: ${sizeMB}MB | Modified: $($_.LastWriteTime)\" -ForegroundColor Red
    }
} else {
    Write-Host \"    [OK] No recent archive files found in temp directories\" -ForegroundColor Green
}

# 8. Windows Defender Exclusions Audit
Write-Host \"\"
Write-Host \"[8] Windows Defender Exclusions Audit...\" -ForegroundColor Yellow
$defenderPrefs = Get-MpPreference -ErrorAction SilentlyContinue
$exclusionsFound = $false
if ($defenderPrefs.ExclusionPath) {
    $defenderPrefs.ExclusionPath | ForEach-Object { Write-Host \"    [!] Excluded Path: $_\" -ForegroundColor Yellow; $exclusionsFound = $true }
}
if ($defenderPrefs.ExclusionProcess) {
    $defenderPrefs.ExclusionProcess | ForEach-Object { Write-Host \"    [!] Excluded Process: $_\" -ForegroundColor Yellow; $exclusionsFound = $true }
}
if (-not $exclusionsFound) {
    Write-Host \"    [OK] No Defender exclusions configured\" -ForegroundColor Green
}

Write-Host \"\"
Write-Host \"========================================\" -ForegroundColor Red
Write-Host \" Scan Complete: $(Get-Date)\" -ForegroundColor Cyan
Write-Host \"========================================\" -ForegroundColor Red
Write-Host \"Escalate ALL flagged items to IR team immediately.\" -ForegroundColor Red


---