QILIN Ransomware: Global Campaign Targets Agriculture & Healthcare via Critical Remote Access Exploits

---
title: Potential ConnectWise ScreenConnect Path Traversal Exploit (CVE-2024-1708)
id: 92d3d5c6-1a2b-4c3d-8e5f-6a7b8c9d0e1f
description: Detects potential exploitation of CVE-2024-1708 via suspicious URI patterns in web logs.
status: experimental
date: 2026/05/20
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
logsource:
    category: web
detection:
    selection:
        c-uri|contains: \"/LiveEvents/\"
        cs-method: 'POST'
    filter_main:
        c-uri|contains:
            - '..%2F'
            - '%2f..%2f'
            - 'AssemblyInjection'
    condition: selection and filter_main
falsepositives:
    - Potential false positives if specific API usage patterns match; verify user-agent context.
level: critical
tags:
    - attack.initial_access
    - cve.2024.1708
    - ransomware.qilin
---
title: SmarterMail Suspicious File Upload or Auth Bypass
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects indicators of SmarterMail exploitation including Auth bypass patterns and unusual file uploads.
status: experimental
date: 2026/05/20
logsource:
    category: web
detection:
    selection_upload:
        c-uri|contains: \"/Services/\"
        cs-method: 'POST'
        c-uri|endswith: '.aspx'
    selection_bypass:
        c-uri|contains:
            - 'ResetPassword.aspx'
            - 'Login.aspx'
        cs-status: 200
        sc-bytes: < 500
    filter_legit:
        cs-user-agent|contains:
            - 'Mozilla'
            - 'SmarterTools'
    condition: (selection_upload and not filter_legit) or (selection_bypass and not filter_legit)
falsepositives:
    - Legacy integration tools with incomplete user-agent strings.
level: high
tags:
    - attack.initial_access
    - cve.2026.23760
    - cve.2025.52691
    - ransomware.qilin
---
title: Qilin Pre-Encryption VSS Shadow Copy Deletion
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects commands used by Qilin affiliates to delete Volume Shadow Copies prior to encryption.
status: experimental
date: 2026/05/20
references:
    - https://securityarsenal.com/darkside
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\\vssadmin.exe'
        CommandLine|contains: 'delete shadows'
    selection_wmic:
        Image|endswith: '\\wbem\\WMIC.exe'
        CommandLine|contains: 'shadowcopy delete'
    condition: 1 of selection_*
falsepositives:
    - System administrators manually managing disk space (rare in automated bulk).
level: critical
tags:
    - attack.impact
    - attack.t1490
    - ransomware.qilin

// Hunt for Qilin lateral movement and staging activity
// Looks for large file movements to network shares and anomalous PowerShell execution
let TimeFrame = 1d;
let SuspiciousProcesses = dynamic([\"powershell.exe\", \"pwsh.exe\", \"cmd.exe\", \"cscript.exe\", \"wscript.exe\"]);
let ExfilExtensions = dynamic([\".zip\", \".rar\", \".7z\", \".tmp\", \".encrypted\"]);
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where InitiatingProcessFileName in~ SuspiciousProcesses
| where ProcessCommandLine has any(ExfilExtensions) or ProcessCommandLine has \"Copy-Item\" or ProcessCommandLine has \"Compress-Archive\"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, FolderPath
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(TimeFrame)
    | where FileExtension in~ ExfilExtensions
    | where FileSize > 1024 * 1024 // > 1MB
    | project Timestamp, DeviceName, FileName, FolderPath, FileSize, InitiatingProcessAccountName
) on DeviceName, Timestamp
| summarize Timestamp = max(Timestamp), FileCount = count(), TotalSizeMB = sum(FileSize/1024/1024) by DeviceName, AccountName
| order by TotalSizeMB desc

<#
.SYNOPSIS
    Qilin Incident Response - Check for VSS Manipulation and Suspicious Scheduled Tasks.
.DESCRIPTION
    Checks for recent deletion of Volume Shadow Copies and enumerates scheduled tasks
    created in the last 7 days, common indicators of Qilin pre-encryption staging.
#>

Write-Host \"[+] QILIN RESPONSE CHECK - $(Get-Date)\" -ForegroundColor Cyan

# Check 1: VSS Shadow Copy Status
Write-Host \"\
[*] Checking Volume Shadow Copy Status...\" -ForegroundColor Yellow
try {
    $shadows = vssadmin list shadows 2>&1
    if ($shadows -match \"No shadow copies found\" -or $shadows -match \"There are no shadow copies\") {
        Write-Host \"[!] CRITICAL: No Shadow Copies found. Possible deletion event.\" -ForegroundColor Red
    } else {
        $count = ($shadows | Select-String \"Shadow Copy Volume\").Count
        Write-Host \"[+] Found $count shadow copies.\" -ForegroundColor Green
    }
} catch {
    Write-Host \"[!] Error checking VSS: $_\" -ForegroundColor Red
}

# Check 2: Scheduled Tasks created in last 7 days
Write-Host \"\
[*] Checking for Scheduled Tasks created/modified in last 7 days...\" -ForegroundColor Yellow
$cutoffDate = (Get-Date).AddDays(-7)
try {
    $tasks = Get-ScheduledTask | Get-ScheduledTaskInfo
    foreach ($task in $tasks) {
        if ($task.LastRunTime -gt $cutoffDate -or $task.State -eq \"Running\") {
            Write-Host \"[!] Suspicious Task: $($task.TaskName) | Last Run: $($task.LastRunTime) | Author: $((Get-ScheduledTask -TaskName $task.TaskName).Author)\" -ForegroundColor Red
        }
    }
    Write-Host \"[*] Scheduled task check complete.\" -ForegroundColor Green
} catch {
    Write-Host \"[!] Error checking Scheduled Tasks: $_\" -ForegroundColor Red
}