QILIN Ransomware Gang: Healthcare Sector Under Siege — 13 New Victims Posted & Critical CVE Exploitation

---
title: Qilin Ransomware - Suspicious RDP Brute Force Activity
id: c2b98f6a-3c2d-45e8-9a66-4c8e9f12a3b4
description: Detects potential Qilin ransomware precursor activity in the form of RDP brute force attacks
status: experimental
author: Security Arsenal Intelligence Team
date: 2026/06/03
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.initial_access
    - attack.t1078
    - attack.t1110
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
        LogonType: 10
        SubStatus:
            - "0xC000006A"
            - "0xC0000234"
            - "0xC0000072"
    filter:
        TargetUserName|re: '(admin|administrator|root)'
    timeframe: 15m
    condition: selection | count() > 20
falsepositives:
    - Misconfigured applications
    - Legitimate users with incorrect passwords
level: high
---
title: Qilin Ransomware - PsExec Lateral Movement
id: d3c98f6a-3c2d-45e8-9a66-4c8e9f12a3b5
description: Detects Qilin ransomware lateral movement using PsExec or similar tools
status: experimental
author: Security Arsenal Intelligence Team
date: 2026/06/03
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.lateral_movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName: 'ADMIN$'
        RelativeTargetName|endswith: 'PSEXESVC.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use of PsExec
level: high
---
title: Qilin Ransomware - Data Exfiltration via SMB
id: e4d98f6a-3c2d-45e8-9a66-4c8e9f12a3b6
description: Detects potential Qilin data exfiltration via SMB, often used before encryption
status: experimental
author: Security Arsenal Intelligence Team
date: 2026/06/03
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.exfiltration
    - attack.t1048.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ShareName:
            - 'C$'
            - 'ADMIN$'
        IpAddress|contains: '192.168.'
    filter:
        SubjectUserName|contains: 'ADMIN'
    timeframe: 5m
    condition: selection | count() > 10
falsepositives:
    - Legitimate administrative access
    - Backup operations
level: medium

// Hunt for Qilin ransomware precursor activity
// This query looks for lateral movement and data staging patterns common to Qilin
let TimeRange = ago(7d);
// Detect suspicious SMB access to admin shares
let AdminShareAccess = SecurityEvent
| where TimeGenerated > TimeRange
| where EventID in (5140, 5145)
| where ShareName in ("C$", "ADMIN$")
| where not(SubjectUserName contains "$")
| summarize count() by Computer, Account=SubjectUserName, ShareName, IpAddress
| where count_ > 10;
// Detect potential PowerShell-based lateral movement
let PowerShellLateral = SecurityEvent
| where TimeGenerated > TimeRange
| where EventID == 4688
| where NewProcessName contains "powershell.exe"
| where CommandLine matches regex @".*(invoke-command|enter-pssession|new-pssession).*"
| summarize count() by Computer, Account=SubjectUserName, CommandLine;
// Detect unusual scheduled task creation
let ScheduledTaskCreation = SecurityEvent
| where TimeGenerated > TimeRange
| where EventID == 4698
| where TaskContent contains @".*\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.*"
| summarize count() by Computer, Account=SubjectUserName, TaskName;
// Combine results
union AdminShareAccess, PowerShellLateral, ScheduledTaskCreation
| project TimeGenerated, ActivityType=case(
    isnotnull(ShareName), "AdminShareAccess",
    isnotnull(CommandLine), "PowerShellLateral",
    isnotnull(TaskName), "ScheduledTaskCreation",
    "Unknown"
), Computer, Account, Details=coalesce(ShareName, CommandLine, TaskName, IpAddress), count_
| order by TimeGenerated desc

<#
.SYNOPSIS
    Qilin Ransomware - Rapid Response Hardening Script
.DESCRIPTION
    This script checks for common Qilin TTPs and applies immediate hardening measures
.NOTES
    Version: 1.0
    Author: Security Arsenal Intelligence Team
    Date: 2026-06-03
#>

# Function to check for recent modifications to VSS
function Check-VSSModifications {
    Write-Host "Checking for recent Volume Shadow Copy modifications..." -ForegroundColor Yellow
    
    try {
        $vssEvents = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Backup/Operational'; ID=5,8,9,14,17,19,20,21,22,49,50,51,52,100,517,518,519,520,521,527,528,544,545,546,561,564,567,569,612,613} -ErrorAction SilentlyContinue | 
                    Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-7) } |
                    Sort-Object TimeCreated -Descending |
                    Select-Object -First 20
                    
        if ($vssEvents) {
            Write-Host "Recent VSS activity detected:" -ForegroundColor Red
            $vssEvents | Format-Table TimeCreated, Id, LevelDisplayName, Message -AutoSize
        } else {
            Write-Host "No recent VSS modifications detected." -ForegroundColor Green
        }
    } catch {
        Write-Host "Error checking VSS modifications: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Function to enumerate scheduled tasks added in the last 7 days
function Check-RecentScheduledTasks {
    Write-Host "Checking for scheduled tasks created in the last 7 days..." -ForegroundColor Yellow
    
    try {
        $tasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) }
        
        if ($tasks) {
            Write-Host "Recently created scheduled tasks:" -ForegroundColor Red
            $tasks | ForEach-Object {
                $taskInfo = Get-ScheduledTaskInfo -TaskName $_.TaskName -TaskPath $_.TaskPath
                [PSCustomObject]@{
                    TaskName = $_.TaskName
                    TaskPath = $_.TaskPath
                    Author = $_.Author
                    Date = $_.Date
                    LastRunTime = $taskInfo.LastRunTime
                    LastTaskResult = $taskInfo.LastTaskResult
                }
            } | Format-Table -AutoSize
        } else {
            Write-Host "No recent scheduled tasks detected." -ForegroundColor Green
        }
    } catch {
        Write-Host "Error checking scheduled tasks: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Function to check for exposed RDP
function Check-ExposedRDP {
    Write-Host "Checking for exposed RDP connections..." -ForegroundColor Yellow
    
    try {
        $rdpEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625} -ErrorAction SilentlyContinue | 
                     Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-7) -and $_.Properties[8].Value -eq 10 } |
                     Group-Object IpAddress | 
                     Where-Object { $_.Count -gt 10 } |
                     Sort-Object Count -Descending
                     
        if ($rdpEvents) {
            Write-Host "High-frequency RDP connection attempts detected:" -ForegroundColor Red
            $rdpEvents | ForEach-Object {
                $ip = $_.Name
                $count = $_.Count
                $geo = try { (Invoke-RestMethod -Uri "http://ip-api.com//$ip").country } catch { "Unknown" }
                [PSCustomObject]@{
                    IPAddress = $ip
                    Country = $geo
                    Attempts = $count
                }
            } | Format-Table -AutoSize
        } else {
            Write-Host "No exposed RDP connections detected." -ForegroundColor Green
        }
    } catch {
        Write-Host "Error checking RDP connections: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Function to check for suspicious processes
function Check-SuspiciousProcesses {
    Write-Host "Checking for suspicious processes..." -ForegroundColor Yellow
    
    $suspiciousProcesses = @(
        "psexec.exe", "psexec64.exe", "psexecsvc.exe",
        "procdump.exe", "procdump64.exe",
        "mimikatz.exe", "mimilib.dll",
        "ransomware.exe", "encrypt.exe", "crypt.exe",
        "vssadmin.exe"
    )
    
    try {
        $processes = Get-Process | Where-Object { $suspiciousProcesses -contains $_.ProcessName.ToLower() }
        
        if ($processes) {
            Write-Host "Suspicious processes detected:" -ForegroundColor Red
            $processes | Format-Table Id, ProcessName, Path, StartTime -AutoSize
        } else {
            Write-Host "No suspicious processes detected." -ForegroundColor Green
        }
    } catch {
        Write-Host "Error checking processes: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Function to apply immediate hardening measures
function Apply-ImmediateHardening {
    Write-Host "`nApplying immediate hardening measures..." -ForegroundColor Yellow
    
    try {
        # Disable RDP if not needed
        $rdpStatus = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections).fDenyTSConnections
        if ($rdpStatus -eq 0) {
            Write-Host "RDP is currently enabled. Disabling now..." -ForegroundColor Yellow
            Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 1
            Write-Host "RDP has been disabled." -ForegroundColor Green
        } else {
            Write-Host "RDP is already disabled." -ForegroundColor Green
        }
        
        # Enable PowerShell Script Block Logging
        $registryPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
        if (-not (Test-Path $registryPath)) {
            New-Item -Path $registryPath -Force | Out-Null
        }
        Set-ItemProperty -Path $registryPath -Name EnableScriptBlockLogging -Value 1 -Force
        Write-Host "PowerShell Script Block Logging has been enabled." -ForegroundColor Green
        
        # Enable Module Logging
        $modulePath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
        if (-not (Test-Path $modulePath)) {
            New-Item -Path $modulePath -Force | Out-Null
        }
        Set-ItemProperty -Path $modulePath -Name EnableModuleLogging -Value 1 -Force
        Write-Host "PowerShell Module Logging has been enabled." -ForegroundColor Green
        
    } catch {
        Write-Host "Error applying hardening measures: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Main execution
Write-Host "=== QILIN RANSOMWARE - RAPID RESPONSE HARDENING ===" -ForegroundColor Cyan
Write-Host "Date: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan

Check-VSSModifications
Check-RecentScheduledTasks
Check-ExposedRDP
Check-SuspiciousProcesses

Write-Host "`n=== RECOMMENDATION ===" -ForegroundColor Cyan
$response = Read-Host "Would you like to apply immediate hardening measures? (Y/N)"
if ($response -eq 'Y' -or $response -eq 'y') {
    Apply-ImmediateHardening
}

Write-Host "`n=== SCAN COMPLETE ===" -ForegroundColor Cyan
Write-Host "For additional assistance, contact Security Arsenal Incident Response." -ForegroundColor Cyan