QILIN Ransomware Gang: 15 New Victims Posted — Global Targeting Analysis & Detection Rules

---
title: Potential Qilin Ransomware Lateral Movement via PsExec
id: 892a1c45-4d13-4b9b-8a7e-3d5e9f6c2a1b
description: Detects potential lateral movement by Qilin ransomware operators using PsExec with parameters commonly associated with their activity
status: experimental
author: Security Arsenal
references:
    - Internal Research
date: 2026/06/08
tags:
    - attack.lateral_movement
    - attack.execution
    - attack.t1569.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\psexec.exe'
        CommandLine|contains:
            - '\\'
            - '-accepteula'
            - '-s'
    condition: selection
falsepositives:
    - Legitimate administrative activities
level: high
---
title: Suspicious ScreenConnect Activity (Qilin Initial Access)
id: a4b3c2d1-5e6f-7g8h-9i0j-1k2l3m4n5o6p
description: Detects potential exploitation of ScreenConnect (CVE-2024-1708) as used by Qilin for initial access
status: experimental
author: Security Arsenal
references:
    - CVE-2024-1708
date: 2026/06/08
tags:
    - attack.initial_access
    - attack.remote_service
    - attack.t1021.004
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 10
        LogonProcessName: 'ScreenConnect'
        ComputerName|startswith: 'WEB'
    filter:
        SubjectUserName|contains:
            - 'admin'
            - 'service'
    condition: selection and not filter
falsepositives:
    - Legitimate remote administration
level: high
---
title: Ransomware Pre-Encryption Staging Activity
id: f7e8d9c0-1a2b-3c4d-5e6f-7g8h9i0j1k2l
description: Detects common ransomware pre-encryption staging indicators observed in Qilin operations
status: experimental
author: Security Arsenal
references:
    - Internal Research
date: 2026/06/08
tags:
    - attack.impact
    - attack.t1486
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wbadmin.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'delete catalog'
            - 'Remove-Item'
            - 'shadowcopy'
            - 'Format-Volume'
    condition: selection
falsepositives:
    - Legitimate system administration
level: critical

// Hunt for potential Qilin lateral movement indicators
let ProcessEvents = SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4688, 5140, 5145)
| extend ProcessName = tostring(NewProcessName), 
         CommandLine = tostring(CommandLine), 
         SubjectUserName = tostring(SubjectUserName),
         TargetUserName = tostring(TargetUserName),
         SourceIp = tostring(IpAddress);
// Detect suspicious PsExec usage
let PsExecEvents = ProcessEvents
| where ProcessName contains "psexec"
| where CommandLine contains "\\" and CommandLine contains "-accepteula"
| project TimeGenerated, Computer, SubjectUserName, ProcessName, CommandLine;
// Detect unusual SMB access patterns
let SMBAccess = ProcessEvents
| where EventID in (5140, 5145)
| where ShareName !in ("ADMIN$", "IPC$", "C$", "NETLOGON", "SYSVOL")
| where TargetUserName != SubjectUserName
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, ShareName, SourceIp, AccessMask;
// Detect potential data exfiltration indicators
let DataExfil = ProcessEvents
| where ProcessName contains "powershell" 
| where CommandLine contains "Compress-Archive" or CommandLine contains "Invoke-WebRequest" or CommandLine contains "Net.WebClient"
| where CommandLine contains ".zip" or CommandLine contains "http"
| project TimeGenerated, Computer, SubjectUserName, ProcessName, CommandLine;
union PsExecEvents, SMBAccess, DataExfil
| order by TimeGenerated desc

# QILIN Ransomware Rapid Response Script
# Run with elevated privileges

Write-Host "[+] Starting QILIN ransomware hardening checks..." -ForegroundColor Yellow

# 1. Check for exposed RDP
$rdpStatus = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($rdpStatus.fDenyTSConnections -eq 0) {
    Write-Host "[!] WARNING: RDP is enabled. Consider disabling if not required." -ForegroundColor Red
    Write-Host "    To disable RDP, run: Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1" -ForegroundColor Yellow
} else {
    Write-Host "[+] RDP is disabled." -ForegroundColor Green
}

# 2. Check for recently created suspicious scheduled tasks
$recentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
if ($recentTasks) {
    Write-Host "[!] Found scheduled tasks created in the last 7 days:" -ForegroundColor Red
    $recentTasks | Format-List TaskName, Date, Author, Actions
} else {
    Write-Host "[+] No suspicious scheduled tasks found from the last 7 days." -ForegroundColor Green
}

# 3. Check for recent Volume Shadow Copy modifications
$shadowCopies = Get-WmiObject -Class Win32_ShadowCopy | Where-Object { $_.InstallDate -gt (Get-Date).AddDays(-7) }
if ($shadowCopies) {
    Write-Host "[!] Found Volume Shadow Copies created/modified in the last 7 days:" -ForegroundColor Yellow
    $shadowCopies | Format-List ID, VolumeName, InstallDate
} else {
    Write-Host "[+] No recent Volume Shadow Copy modifications found." -ForegroundColor Green
}

# 4. Check for PowerShell logging status
$psLogging = Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -ErrorAction SilentlyContinue
if (-not $psLogging -or $psLogging.EnableScriptBlockLogging -ne 1) {
    Write-Host "[!] WARNING: PowerShell Script Block Logging is not enabled." -ForegroundColor Red
    Write-Host "    To enable, run: Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -Value 1 -Force" -ForegroundColor Yellow
} else {
    Write-Host "[+] PowerShell Script Block Logging is enabled." -ForegroundColor Green
}

# 5. Check for ScreenConnect service
$screenConnect = Get-Service -Name "ScreenConnect*" -ErrorAction SilentlyContinue
if ($screenConnect) {
    Write-Host "[!] WARNING: ScreenConnect service detected. Ensure it's patched against CVE-2024-1708." -ForegroundColor Red
    $screenConnect | Format-List Name, Status, StartType
} else {
    Write-Host "[+] No ScreenConnect services detected." -ForegroundColor Green
}

Write-Host "[+] Hardening check complete." -ForegroundColor Yellow