QILIN Ransomware Gang: Healthcare & Energy Sector Attacks Surge — Detection & Response Guidance

---
title: Potential RDP Brute Force Attack
id: a1b2c3d4-e5f6-7890-g1h2-i3j4k5l6m7n8
description: Detects potential RDP brute force attacks commonly used for initial access by ransomware groups
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://attack.mitre.org/techniques/T1078/
tags:
    - attack.initial_access
    - attack.credential_access
    - qilin
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
        LogonType: 10
    filter:
        SubjectUserName|startswith: 'DWM-'
        SubjectUserName|startswith: 'UMFD-'
    condition: selection | count(SubjectUserName) > 10 | by SourceIpAddress within 1m
falsepositives:
    - Legitimate users mistyping passwords
    - Misconfigured applications
level: high
---
title: PsExec Lateral Movement Detection
id: b2c3d4e5-f6a7-8901-h2i3-j4k5l6m7n8o9
description: Detects lateral movement using PsExec, a common tool used by Qilin and other ransomware groups
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://attack.mitre.org/techniques/T1021/
    - https://attack.mitre.org/techniques/T1569/
tags:
    - attack.lateral_movement
    - attack.execution
    - qilin
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 5145
            - 5140
        ShareName|contains: 'ADMIN$'
        RelativeTargetName|contains: 'PSEXESVC'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and not filter
falsepositives:
    - Legitimate system administration
    - Software deployment tools
level: high
---
title: Suspicious Volume Shadow Copy Deletion
id: c3d4e5f6-a7b8-9012-i3j4-k5l6m7n8o9p0
description: Detects deletion of Volume Shadow Copies, a common pre-encryption step by ransomware operators
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://attack.mitre.org/techniques/T1490/
tags:
    - attack.impact
    - defense_evasion
    - qilin
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ObjectName|contains: 'HarddiskVolumeShadowCopy'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and not filter
falsepositives:
    - Legitimate system administration
    - Backup software operations
level: critical

// Hunt for potential Qilin lateral movement indicators
let Timeframe = 1d;
let HighRiskSourceIPs = materialize (
    SecurityEvent 
    | where TimeGenerated > ago(Timeframe)
    | where EventID in (4625, 4768, 4769)  // Failed logons and Kerberos events
    | summarize FailedAttempts = count() by IpAddress
    | where FailedAttempts >= 10
    | project IpAddress
);
SecurityEvent
| where TimeGenerated > ago(Timeframe)
// Detect unusual service installations (PsExec and WMI)
| where EventID in (4697, 7045)
// Look for remote executions
| union (
    Event 
    | where TimeGenerated > ago(Timeframe)
    | where EventID == 10  // Process execution
    | where ProcessCommandLine contains "\\" and ProcessCommandLine contains "-machine"
)
| where IpAddress in (HighRiskSourceIPs)
| summarize count() by Computer, IpAddress, EventID, ProcessCommandLine
| order by count_ desc

# Qilin Ransomware Quick Assessment Script
# Run with Administrator privileges

Write-Host "[+] Starting Qilin Ransomware Quick Assessment..." -ForegroundColor Cyan

# Check for exposed RDP services
Write-Host "\n[+] Checking RDP exposure..." -ForegroundColor Yellow
$rdpStatus = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($rdpStatus.fDenyTSConnections -eq 0) {
    Write-Host "[!] RDP is ENABLED - Potential risk" -ForegroundColor Red
    $rdpListeners = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "PortNumber" -ErrorAction SilentlyContinue
    Write-Host "    RDP Port: $($rdpListeners.PortNumber)" -ForegroundColor Yellow
} else {
    Write-Host "[+] RDP is DISABLED" -ForegroundColor Green
}

# Check for recent scheduled tasks (potential persistence)
Write-Host "\n[+] Checking for recently created scheduled tasks..." -ForegroundColor Yellow
$cutoffDate = (Get-Date).AddDays(-7)
$recentTasks = Get-ScheduledTask | Where-Object { 
    $_.Date -gt $cutoffDate -and 
    $_.Author -notmatch "Microsoft|NT AUTHORITY" 
}
if ($recentTasks) {
    Write-Host "[!] Found $($recentTasks.Count) recently created tasks:" -ForegroundColor Red
    $recentTasks | Format-Table TaskName, Author, Date -AutoSize
} else {
    Write-Host "[+] No suspicious scheduled tasks found" -ForegroundColor Green
}

# Check for recently modified Volume Shadow Copies
Write-Host "\n[+] Checking Volume Shadow Copy status..." -ForegroundColor Yellow
try {
    $shadowCopies = Get-WmiObject Win32_ShadowCopy
    if ($shadowCopies) {
        $recentVSS = $shadowCopies | Where-Object { $_.InstallDate -gt (Get-Date).AddHours(-24) }
        if ($recentVSS) {
            Write-Host "[+] Volume Shadow Copies active and recent" -ForegroundColor Green
            $recentVSS | ForEach-Object { Write-Host "    Created: $($_.InstallDate) on $($_.VolumeName)" -ForegroundColor White }
        } else {
            Write-Host "[!] No recent Volume Shadow Copies found" -ForegroundColor Yellow
        }
    } else {
        Write-Host "[!] No Volume Shadow Copies found" -ForegroundColor Red
    }
} catch {
    Write-Host "[!] Could not check Volume Shadow Copies: $_" -ForegroundColor Red
}

# Check for unusual network connections
Write-Host "\n[+] Checking for established RDP connections..." -ForegroundColor Yellow
$rdpSessions = qwinsta 2>$null | Select-String "rdp-tcp"
if ($rdpSessions) {
    Write-Host "[!] Active RDP sessions found:" -ForegroundColor Red
    $rdpSessions
} else {
    Write-Host "[+] No active RDP sessions" -ForegroundColor Green
}

Write-Host "\n[+] Assessment complete. Review findings for potential Qilin indicators." -ForegroundColor Cyan