QILIN Ransomware Gang: 15 New Victims Posted — Sector Targeting Analysis & Detection Rules

title: QILIN Ransomware Initial Access - Suspicious IKEv2 VPN Authentication Anomaly
category: initial_access
status: experimental
description: >
  Detects anomalous IKEv2 negotiation patterns consistent with CVE-2026-50751
  exploitation against Check Point Security Gateway. QILIN affiliates have been
  observed leveraging this vulnerability for unauthenticated initial access to
  internal networks via VPN session hijack.
author: Security Arsenal Threat Intelligence
date: 2026/06/30
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://ransomware.live/#/group/qilin
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
logsource:
  product: firewall
  service: vpn
detection:
  selection_failed_then_success:
    action: failed
    tunnel_type: ikev2
    timeframe: 5m
    condition: count() >= 5
  selection_success_anomaly:
    action: success
    tunnel_type: ikev2
    user|contains:
      - 'admin'
      - 'root'
      - 'service'
    source_ip|cidr:
      - '0.0.0.0/0'
  filter_known_vpn_ranges:
    source_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
    condition: not selection_success_anomaly
  condition: selection_failed_then_success or (selection_success_anomaly and not filter_known_vpn_ranges)
fields:
  - source_ip
  - user
  - tunnel_type
  - action
  - bytes_in
  - bytes_out
falsepositives:
  - Legitimate admin VPN from new geographic location
  - Load balancer health check misconfiguration
level: high
---
title: QILIN Pre-Encryption Volume Shadow Copy Deletion and Service Tampering
category: impact
status: experimental
description: >
  Detects Volume Shadow Copy deletion and Windows Defender/EDR service tampering
  executed via command-line utilities. This combination is a hallmark of QILIN
  pre-detonation preparation and is observed 30-120 minutes prior to encryptor
  deployment in confirmed QILIN intrusions.
author: Security Arsenal Threat Intelligence
date: 2026/06/30
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1562/001/
logsource:
  product: windows
  service: security
detection:
  selection_vssadmin:
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains:
      - 'delete'
      - 'shadows'
  selection_wmic:
    Image|endswith: '\\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy'
      - 'delete'
  selection_powershell_vss:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - 'Get-WmiObject Win32_ShadowCopy'
      - 'Remove-WmiObject'
      - '(Get-WmiObject Win32_ShadowCopy).Delete()'
  selection_defender_disable:
    Image|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\sc.exe'
    CommandLine|contains|all:
      - 'WinDefend'
      - 'stop'
    CommandLine|contains:
      - 'Set-MpPreference -DisableRealtimeMonitoring $true'
      - 'Set-MpPreference -DisableIOAVProtection $true'
      - 'Add-MpPreference -ExclusionPath'
  selection_bcdedit:
    Image|endswith: '\\bcdedit.exe'
    CommandLine|contains: 'recoveryenabled no'
  condition: selection_vssadmin or selection_wmic or selection_powershell_vss or selection_defender_disable or selection_bcdedit
fields:
  - ComputerName
  - User
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - Legitimate backup software maintenance windows (validate via change ticket)
  - Authorized admin disaster recovery testing
level: critical
---
title: QILIN Lateral Movement via PsExec WMI and Cobalt Strike Named Pipes
category: lateral_movement
status: experimental
description: >
  Detects QILIN affiliate lateral movement patterns including PsExec service
  creation, WMI process call execution, and Cobalt Strike default named pipe
  usage. QILIN affiliates favor PsExec for SMB-based deployment and WMI for
  stealth lateral execution prior to ransomware detonation.
author: Security Arsenal Threat Intelligence
date: 2026/06/30
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1047/
  - https://attack.mitre.org/techniques/T1571/
logsource:
  product: windows
  service: security
detection:
  selection_psexec_service:
    EventID: 7045
    ServiceName|startswith:
      - 'PSEXESVC'
      - 'RemComSvc'
  selection_psexec_share:
    EventID: 5145
    ShareName: '\\\\*\\ADMIN$\\*'
    RelativeTargetName|contains:
      - 'PSEXESVC.exe'
      - 'RemCom_' 
  selection_wmi_process_create:
    Image|endswith: '\\wmic.exe'
    CommandLine|contains: 'process call create'
  selection_wmi_event_consumer:
    EventID: 19
    EventType: 'WmiEventConsumer'
    Consumer|contains: 'CommandLine'
  selection_cs_named_pipe:
    Image|endswith:
      - '\\rundll32.exe'
      - '\\svchost.exe'
      - '\\RuntimeBroker.exe'
    PipeName|startswith:
      - '\\\\PIPE\\\\postex_'
      - '\\\\PIPE\\\\status_'
      - '\\\\PIPE\\\\msagent_'
      - '\\\\PIPE\\\\POPCORN'
      - '\\\\PIPE\\\\PGPIPE'
  selection_cs_anomalous_pipe:
    PipeName|re: '(\\\\PIPE\\\\[a-zA-Z0-9]{5,9})$'
    Image|endswith:
      - '\\rundll32.exe'
      - '\\svchost.exe'
  condition: selection_psexec_service or selection_psexec_share or selection_wmi_process_create or selection_wmi_event_consumer or selection_cs_named_pipe or selection_cs_anomalous_pipe
fields:
  - ComputerName
  - SourceImage
  - TargetImage
  - PipeName
  - CommandLine
  - User
falsepositives:
  - Legitimate PsExec usage by sysadmin tooling (validate source + ticket)
  - SCCM agent service creation
  - Legitimate WMI administrative scripts
level: high

// QILIN Pre-Ransomware Lateral Movement Hunt — 14-day lookback
// Author: Security Arsenal Threat Intelligence
// Pivot on: PsExec, WMI, VSS deletion, scheduled task abuse, CS beacons
let qilin_psexec = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("PSEXESVC", "RemComSvc", "\\\\ADMIN$\\");
let qilin_wmi = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "wmic.exe" and ProcessCommandLine has "process call create";
let qilin_vss = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (FileName in~ ("vssadmin.exe", "wmic.exe", "powershell.exe", "pwsh.exe"))
        and ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "Win32_ShadowCopy", "Remove-WmiObject");
let qilin_schtasks = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("schtasks.exe", "powershell.exe")
        and ProcessCommandLine has_any ("/create", "Register-ScheduledTask")
        and ProcessCommandLine has_any ("rundll32", "regsvr32", "powershell", "cmd.exe", ".bat", ".ps1");
let qilin_defender_tamper = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("Set-MpPreference -DisableRealtimeMonitoring", "Add-MpPreference -ExclusionPath", "sc stop WinDefend", "bcdedit /set recoveryenabled no");
let qilin_lsass_access = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("comsvcs.dll", "MiniDump", "procdump", "lsass.dmp")
        or (FileName in~ ("procdump.exe", "taskmgr.exe") and ProcessCommandLine has "lsass");
let qilin_exfil_tools = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("rclone.exe", "mega.exe", "FileZilla.exe", "7z.exe", "winrar.exe", "ngrok.exe")
        or ProcessCommandLine has_any ("mega.nz", "mega.io", "anonfiles", "gofile.io", "rclone", "--upload-file");
union qilin_psexec, qilin_wmi, qilin_vss, qilin_schtasks, qilin_defender_tamper, qilin_lsass_access, qilin_exfil_tools
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| extend suspicion_score = case(
    ProcessCommandLine has "delete shadows", 5,
    ProcessCommandLine has "comsvcs.dll" or ProcessCommandLine has "MiniDump", 4,
    ProcessCommandLine has "Set-MpPreference -DisableRealtimeMonitoring", 5,
    ProcessCommandLine has "rclone" or ProcessCommandLine has "mega.nz", 4,
    ProcessCommandLine has "process call create", 3,
    ProcessCommandLine has "PSEXESVC", 3,
    1)
| where suspicion_score >= 3
| sort by TimeGenerated desc, suspicion_score desc
| summarize event_count = count(), first_seen = min(TimeGenerated), last_seen = max(TimeGenerated), techniques = makeset(FileName), commands = makeset(ProcessCommandLine) by DeviceName, AccountName
| extend days_active = datetime_diff('day', last_seen, first_seen)
| sort by event_count desc

<#
.SYNOPSIS
  QILIN Rapid Posture & Detection Sweep
.DESCRIPTION
  Enumerates indicators relevant to QILIN pre-ransomware activity:
  - RDP exposure status
  - Scheduled tasks created in last 7 days
  - Volume Shadow Copy status and recent deletions
  - Windows Defender exclusions and real-time protection state
  - Suspicious services (PsExec, CS beacons, custom services)
  - LSASS protection configuration
.AUTHOR
  Security Arsenal Threat Intelligence
.DATE
  2026-06-30
#>

[CmdletBinding()]
param(
    [int]$TaskLookbackDays = 7
)

$ErrorActionPreference = 'SilentlyContinue'
$report = [ordered]@{
    HostName       = $env:COMPUTERNAME
    ScanTime       = (Get-Date -Format 'yyyy-MM-dd HH:mm:ss zzz')
    Findings       = @()
}

function Add-Finding {
    param([string]$Category,[string]$Severity,[string]$Detail,[string]$Remediation)
    $report.Findings += [PSCustomObject]@{
        Category   = $Category
        Severity   = $Severity
        Detail     = $Detail
        Remediation= $Remediation
        Timestamp  = (Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
    }
}

# --- 1. RDP exposure ---
$rdpReg = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections
$rdpEnabled = ($rdpReg.fDenyTSConnections -eq 0)
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber).PortNumber
$firewallRdp = Get-NetFirewallRule -DisplayName '*Remote Desktop*' -Enabled True -Direction Inbound -Action Allow
if ($rdpEnabled) {
    Add-Finding 'RDP' 'HIGH' "RDP is ENABLED on port $rdpPort with $($firewallRdp.Count) inbound allow rules" 'Disable RDP where unused; restrict via VPN + MFA; enforce Account Lockout policy; enable NLA'
} else {
    Add-Finding 'RDP' 'INFO' 'RDP is disabled' 'No action required'
}

# --- 2. Scheduled tasks created in last N days (QILIN persistence / detonation timer) ---
$cutoff = (Get-Date).AddDays(-$TaskLookbackDays)
$tasks = Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' -and $_.Date -ge $cutoff }
$suspTasks = $tasks | Where-Object {
    $_.Actions.Execute -match 'rundll32|regsvr32|powershell|cmd|wscript|cscript' -or
    $_.Actions.Arguments -match 'http|\\\\\\\\|base64|DownloadString|Invoke-|FromBase64String'
}
foreach ($t in $suspTasks) {
    Add-Finding 'ScheduledTask' 'HIGH' "Suspicious task '$($t.TaskName)' created $($t.Date) executing $($t.Actions.Execute) $($t.Actions.Arguments)" 'Review task author, disable if unauthorized, capture action binary for analysis'
}
if (-not $suspTasks) { Add-Finding 'ScheduledTask' 'INFO' "No suspicious tasks in last $TaskLookbackDays days" 'Continue monitoring' }

# --- 3. Volume Shadow Copy status ---
$vss = Get-WmiObject Win32_ShadowCopy
if (-not $vss) {
    Add-Finding 'VSS' 'WARN' 'No Volume Shadow Copies present — possible prior deletion or never enabled' 'Enable VSS; configure regular snapshots; alert on vssadmin delete shadows'
} else {
    Add-Finding 'VSS' 'INFO' "$($vss.Count) shadow copies present, oldest $($vss[0].InstallDate)" 'Monitor for deletion events (Event ID 7036 VSS service stop, PowerShell Win32_ShadowCopy.Delete)'
}

# Event log: vssadmin delete in last 7 days
$vssDeleteEvents = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=$cutoff} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'delete.*shadow|Win32_ShadowCopy|vssadmin' }
if ($vssDeleteEvents) {
    foreach ($e in $vssDeleteEvents) {
        Add-Finding 'VSS' 'CRITICAL' "VSS deletion script observed at $($e.TimeCreated): $($e.Message.Substring(0,[Math]::Min(300,$e.Message.Length)))" 'Trigger IR playbook immediately — possible ransomware preparation'
    }
}

# --- 4. Defender exclusions and real-time protection ---
$defender = Get-MpPreference
if ($defender.DisableRealtimeMonitoring) {
    Add-Finding 'Defender' 'CRITICAL' 'Real-time protection is DISABLED' 'Re-enable immediately; investigate who/what disabled it; review Event ID 5001'
}
$exclusions = @()
$exclusions += $defender.ExclusionPath
$exclusions += $defender.ExclusionProcess
$exclusions += $defender.ExclusionExtension
$suspExclusions = $exclusions | Where-Object { $_ -match '\\.exe$|\\.dll$|^C:\\\\Users|^\\\\\\\\|\\*' }
foreach ($x in $suspExclusions) {
    Add-Finding 'Defender' 'HIGH' "Suspicious Defender exclusion: $x" 'Remove exclusion; scan excluded path; investigate who added it (Get-MpPreference logs)'
}

# --- 5. Suspicious services (PsExec remnants, CS beacon services, random-named services) ---
$services = Get-CimInstance Win32_Service
$psexec = $services | Where-Object { $_.Name -match 'PSEXESVC|RemCom' }
foreach ($s in $psexec) {
    Add-Finding 'Service' 'HIGH' "PsExec/RemCom service '$($s.Name)' present, state=$($s.State), path=$($s.PathName)" 'Validate authorized admin use; remove if unexpected; correlate with source host'
}
$randomServices = $services | Where-Object {
    $_.Name -match '^[a-zA-Z0-9]{6,12}$' -and
    $_.PathName -match 'rundll32|regsvr32|cmd|powershell' -and
    $_.State -eq 'Running'
}
foreach ($s in $randomServices) {
    Add-Finding 'Service' 'CRITICAL' "Random-named service '$($s.Name)' running: $($s.PathName)" 'Stop and disable service; capture binary; submit to sandbox; trigger IR'
}

# --- 6. LSASS protection ---
$lsassReg = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue
if ($lsassReg.RunAsPPL -ne 1) {
    Add-Finding 'LSASS' 'HIGH' 'RunAsPPL not enabled — LSASS unprotected from credential dump' 'Enable RunAsPPL=1 via GPO; deploy Windows Defender Credential Guard; monitor for LSASS access'
} else {
    Add-Finding 'LSASS' 'INFO' 'RunAsPPL enabled' 'No action required'
}

# --- 7. Local admin enumeration (QILIN uses local admin re-use for lateral movement) ---
$localAdmins = Get-LocalGroupMember -Group 'Administrators'
if ($localAdmins.Count -gt 5) {
    Add-Finding 'LocalAdmin' 'WARN' "$($localAdmins.Count) local admins on this host: $($localAdmins.Name -join ', ')" 'Reduce local admin sprawl; implement LAPS; rotate credentials'
}

# --- Output ---
[PSCustomObject]$report | ConvertTo-Json -Depth 5

$summary = $report.Findings | Group-Object Severity | Sort-Object @{Expression={[int][char[]]($_.Name)[0]}}
Write-Host "`n=== QILIN POSTURE SWEEP SUMMARY: $($env:COMPUTERNAME) ===" -ForegroundColor Cyan
$summary | ForEach-Object { Write-Host ("{0,-12}: {1}" -f $_.Name, $_.Count) }
Write-Host "================================" -ForegroundColor Cyan


---