QILIN Ransomware Gang: 18 New Victims Posted — Critical Infrastructure & Tech Sector Targeting

title: Potential Exploitation of ConnectWise ScreenConnect CVE-2024-1708
description: Detects potential exploitation of the path traversal vulnerability in ConnectWise ScreenConnect (CVE-2024-1708) by identifying suspicious web requests to the Login.aspx page.
status: experimental
author: Security Arsenal
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1708
date: 2026/05/23
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '..\\'
            - '..%2f'
            - '..%5c'
        cs-uri-stem|endswith: '/Login.aspx'
    condition: selection
fields:
    - cs-uri-query
    - c-ip
    - cs-user-agent
falsepositives:
    - Potential false positives from legitimate but misconfigured scanners.
level: high
---
title: Qilin Lateral Movement via PsExec and WMI
description: Detects potential Qilin ransomware lateral movement activity by identifying the creation of new services using PsExec or the execution of commands via WMI, common techniques for spreading across a network.
status: experimental
author: Security Arsenal
references:
    - attack.lateral_movement
date: 2026/05/23
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
logsource:
    category: process_creation
detection:
    selection_psexec:
        Image|endswith:
            - '\\psexec.exe'
            - '\\psexec64.exe'
        CommandLine|contains:
            - 'accepteula'
            - '-d'
    selection_wmi:
        Image|endswith:
            - '\\wmic.exe'
            - '\\powershell.exe'
        CommandLine|contains:
            - 'process call create'
            - 'Invoke-WmiMethod'
    condition: 1 of selection*
fields:
    - Image
    - CommandLine
    - ParentImage
falsepositives:
    - Legitimate administrative activity.
level: medium
---
title: Ransomware Data Staging Activity via Rclone

description: Detects the use of Rclone, a command-line program often used by threat actors for data exfiltration. This rule looks for the execution of rclone.exe with flags typical for transferring data to remote storage.
status: experimental
author: Security Arsenal
references:
    - attack.exfiltration
    - cve-2024-1708
date: 2026/05/23
tags:
    - attack.exfiltration
    - attack.t1041
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'config'
            - 'swift:'
            - 's3:'
            - 'gdrive:'
            - 'onedrive:'
    condition: selection
fields:
    - Image
    - CommandLine
    - User
    - ParentImage
falsepositives:
    - Legitimate use of rclone by system administrators.
level: high

// Hunt for potential Qilin pre-ransomware staging and exfiltration activity
// Looks for high-volume file access and unusual process execution on endpoints
let TimeFrame = 1d;
let HighVolumeAccess = 
    DeviceProcessEvents
    | where Timestamp >= ago(TimeFrame)
    // Detect file archiving tools often used in staging
    | where ProcessName in~ ("winrar.exe", "7z.exe", "winzip.exe", "tar.exe")
    | project Timestamp, DeviceName, AccountName, ProcessName, FolderPath, ProcessCommandLine, InitiatingProcessFileName;
let ExfilTools = 
    DeviceProcessEvents
    | where Timestamp >= ago(TimeFrame)
    // Detect common exfiltration tools like rclone, winscp, or file transfer protocols
    | where ProcessName in~ ("rclone.exe", "winscp.exe", "pscp.exe", "scp.exe", "curl.exe", "wget.exe")
    | project Timestamp, DeviceName, AccountName, ProcessName, ProcessCommandLine, InitiatingProcessFileName;
union HighVolumeAccess, ExfilTools
| summarize Count = count(), Processes = make_set(ProcessName), CommandLines = make_set(ProcessCommandLine) by DeviceName, bin(Timestamp, 1h)
| where Count > 5 // Threshold for suspicious activity
| order by Count desc
| extend Recommendation = "Investigate device for signs of ransomware staging and exfiltration."

# Qilin Ransomware Rapid Response Check
# Run on a potentially compromised endpoint

Write-Host "Starting Qilin Ransomware Rapid Response Checks..." -ForegroundColor Yellow

# Check 1: Enumerate scheduled tasks created in the last 7 days
Write-Host "\n[+] Checking for recently created Scheduled Tasks..." -ForegroundColor Cyan
$DateCutoff = (Get-Date).AddDays(-7)
$NewTasks = Get-ScheduledTask | Where-Object { $_.Date -gt $DateCutoff }

if ($NewTasks) {
    Write-Host "ALERT: Found $($NewTasks.Count) new scheduled task(s) created since $DateCutoff:" -ForegroundColor Red
    $NewTasks | ForEach-Object { Write-Host "    - Task Name: $($_.TaskName), Author: $($_.Author), Created: $($_.Date)" }
} else {
    Write-Host "No new scheduled tasks found." -ForegroundColor Green
}

# Check 2: Find recently modified/deleted Volume Shadow Copies
Write-Host "\n[+] Checking for VSS (Volume Shadow Copy) manipulation..." -ForegroundColor Cyan
try {
    $VssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ID=7036,7040,7041} -MaxEvents 100 -ErrorAction SilentlyContinue |
        Where-Object { $_.TimeCreated -gt $DateCutoff -and $_.Message -like '*VSS*' }
    if ($VssEvents) {
        Write-Host "ALERT: Found potential VSS manipulation events:" -ForegroundColor Red
        $VssEvents | ForEach-Object { Write-Host "    - Time: $($_.TimeCreated), EventID: $($_.Id), Message: $($_.Message)" }
    } else {
        Write-Host "No suspicious VSS events found." -ForegroundColor Green
    }
} catch {
    Write-Host "Could not query VSS events." -ForegroundColor Gray
}

# Check 3: Scan for known staging and exfiltration tools
Write-Host "\n[+] Scanning for known staging and exfiltration tools in common paths..." -ForegroundColor Cyan
$PathsToScan = @("$env:SystemRoot\System32", "$env:ProgramFiles", "$env:ProgramFiles(x86)", $env:USERPROFILE)
$ToolNames = @("rclone.exe", "winscp.exe", "pscp.exe", "7z.exe", "winrar.exe")
$FoundTools = @()

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        foreach ($Tool in $ToolNames) {
            $ToolPath = Get-ChildItem -Path $Path -Filter $Tool -Recurse -ErrorAction SilentlyContinue
            if ($ToolPath) {
                $FoundTools += $ToolPath.FullName
            }
        }
    }
}

if ($FoundTools) {
    Write-Host "ALERT: Found known staging/exfil tools:" -ForegroundColor Red
    $FoundTools | ForEach-Object { Write-Host "    - $($_)" }
} else {
    Write-Host "No known tools found in default paths." -ForegroundColor Green
}

# Check 4: Look for new and unusual user accounts
Write-Host "\n[+] Checking for recently created local user accounts..." -ForegroundColor Cyan
$NewUsers = Get-LocalUser | Where-Object { $_.PrincipalSource -eq "Local" -and $_.LastLogon -gt $DateCutoff }
if ($NewUsers) {
    Write-Host "ALERT: Found newly created local user accounts:" -ForegroundColor Red
    $NewUsers | ForEach-Object { Write-Host "    - Username: $($_.Name), Description: $($_.Description), LastLogon: $($_.LastLogon)" }
} else {
    Write-Host "No new local user accounts found." -ForegroundColor Green
}

Write-Host "\nRapid Response Checks Complete." -ForegroundColor Yellow
Write-Host "Review any ALERTS above for potential indicators of Qilin activity." -ForegroundColor Yellow


---