QILIN Ransomware Gang: 23 New Victims Posted — Construction & Manufacturing Sector Targeting Analysis & Detection Rules

---
title: Potential Qilin Ransomware Lateral Movement via PsExec
id: 764e075d-5e1f-4d9b-8f7f-1a2b3c4d5e6f
description: Detects potential Qilin ransomware lateral movement using PsExec with suspicious parameters
status: experimental
date: 2026/05/21
author: Security Arsenal Research Team
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.execution
    - attack.lateral_movement
    - attack.t1021.002
    - qilin
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\psexec.exe'
        CommandLine|contains: 
            - ' -accepteula '
            - ' -u '
            - ' -p '
    filter_legit:
        ParentImage|endswith: 
            - '\mmc.exe'
            - '\services.msc'
            - '\taskmgr.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative activity
level: high

---
title: Qilin Ransomware Data Staging via Rclone
id: 785e085d-5e1f-4d9b-8f7f-1a2b3c4d5e6f
description: Detects potential Qilin ransomware data exfiltration using Rclone tool
status: experimental
date: 2026/05/21
author: Security Arsenal Research Team
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.exfiltration
    - attack.t1048
    - qilin
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rclone.exe'
        CommandLine|contains: 
            - 'copy '
            - 'sync '
            - 'config '
    condition: selection
falsepositives:
    - Legitimate use of Rclone for backup purposes
level: high

---
title: Qilin Ransomware Preparation - Volume Shadow Copy Deletion
id: 796e095d-5e1f-4d9b-8f7f-1a2b3c4d5e6f
description: Detects potential Qilin ransomware preparation by deleting Volume Shadow Copies
status: experimental
date: 2026/05/21
author: Security Arsenal Research Team
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.impact
    - attack.t1490
    - qilin
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains: 
            - 'delete shadows'
            - 'resize shadowstorage'
    condition: selection
falsepositives:
    - System administration tasks
level: high

// Hunt for potential Qilin ransomware lateral movement indicators
let timeframe = 7d;
DeviceProcessEvents
| where Timestamp > ago(timeframe)
| where InitiatingProcessFileName in ("psexec.exe", "wmic.exe", "wmiexec.ps1", "powershell.exe", "cmd.exe")
| where ProcessCommandLine has any(
    "-accepteula", "process call create", "Invoke-WmiMethod", "New-PSSession", 
    "Enter-PSSession", "Invoke-Command", "sc.exe", "net use", "net.exe"
)
| where ProcessCommandLine has any(
    "\\\\", "C$\", "ADMIN$\", "/user:", "/password:", ":5985", ":5986"
)
| extend MachineName = DeviceName, Account = InitiatingProcessAccountName, 
          Process = FileName, CommandLine = ProcessCommandLine
| project Timestamp, MachineName, Account, Process, CommandLine, 
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

# Qilin Ransomware Hardening Script
# Checks for common indicators and applies immediate protective measures

# Function to check for recent scheduled tasks (potential Qilin persistence)
function Check-ScheduledTasks {
    Write-Host "Checking for recently created scheduled tasks..." -ForegroundColor Yellow
    $tasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
    if ($tasks) {
        Write-Host "Found recent scheduled tasks:" -ForegroundColor Red
        $tasks | Format-Table TaskName, Date, Author, State
    } else {
        Write-Host "No suspicious recent scheduled tasks found." -ForegroundColor Green
    }
}

# Function to check for modified Volume Shadow Copies
function Check-ShadowCopies {
    Write-Host "Checking Volume Shadow Copy status..." -ForegroundColor Yellow
    try {
        $vss = vssadmin list shadows
        if ($vss -match "No shadow copies") {
            Write-Host "WARNING: No Volume Shadow Copies found - potential deletion." -ForegroundColor Red
        } else {
            $shadowCount = ($vss | Select-String "Shadow Copy Volume").Count
            Write-Host "Found $shadowCount Volume Shadow Copies." -ForegroundColor Green
        }
    } catch {
        Write-Host "Could not check Volume Shadow Copies: $_" -ForegroundColor Red
    }
}

# Function to enumerate RDP connections
function Check-RDPConnections {
    Write-Host "Checking recent RDP connections..." -ForegroundColor Yellow
    $rdpEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
        Where-Object {$_.Message -match 'Logon Type: 10'} |
        Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='SourceIP';E={$_.Properties[18].Value}}
    
    if ($rdpEvents) {
        Write-Host "Recent RDP connections found:" -ForegroundColor Yellow
        $rdpEvents | Format-Table -AutoSize
    } else {
        Write-Host "No recent RDP connections found." -ForegroundColor Green
    }
}

# Function to check for exposed RDP
function Check-ExposedRDP {
    Write-Host "Checking if RDP is exposed..." -ForegroundColor Yellow
    $rdpStatus = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
    if ($rdpStatus.fDenyTSConnections -eq 0) {
        Write-Host "WARNING: RDP is enabled. Consider disabling or securing with MFA." -ForegroundColor Red
        
        # Check firewall rules
        $firewallRules = Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Where-Object {$_.Enabled -eq 'True'}
        if ($firewallRules) {
            Write-Host "RDP is allowed through firewall. Check scope restrictions." -ForegroundColor Red
        }
    } else {
        Write-Host "RDP is disabled." -ForegroundColor Green
    }
}

# Execute all checks
Write-Host "========================================" -ForegroundColor Cyan
Write-Host "QILIN RANSOMWARE SECURITY CHECK" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan
Write-Host ""

Check-ScheduledTasks
Write-Host ""
Check-ShadowCopies
Write-Host ""
Check-RDPConnections
Write-Host ""
Check-ExposedRDP
Write-Host ""
Write-Host "========================================" -ForegroundColor Cyan
Write-Host "CHECK COMPLETE" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan