Qilin Ransomware Leader Arrested After Extradition: Detection and Defense Playbook for the Group's Encryptor and Lateral Movement

---
title: Ransomware Shadow Copy Deletion and Recovery Disablement
id: 4f2b8c91-6d3e-4a7b-b5c2-9e1d0f8a3c47
status: experimental
description: Detects deletion of Volume Shadow Copies and disabling of Windows recovery options, a hallmark pre-encryption behavior of Qilin ransomware affiliates.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.bleepingcomputer.com/news/security/germany-arrests-alleged-core-qilin-ransomware-member-after-extradition/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection_img_vss or selection_bcdedit
falsepositives:
  - Legitimate storage administrators resizing shadow storage (resize shadowstorage) uses different command lines
  - Rare backup software maintenance scripts
level: high
---
title: Backup and Database Service Termination Before Encryption
id: 8a1e4d72-3c9f-4b6a-a2d8-7f5e1b9c4d06
status: experimental
description: Detects mass stopping of backup, database, and security services via net.exe or sc.exe, consistent with Qilin pre-encryption sabotage of recovery and detection capabilities.
references:
  - https://attack.mitre.org/techniques/T1489/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
    CommandLine|contains:
      - 'stop veeam'
      - 'stop sql'
      - 'stop mssql'
      - 'stop backup'
      - 'stop vss'
      - 'stop sophos'
      - 'stop mssense'
      - 'stop exchange'
      - 'stop msexchange'
falsepositives:
  - Legitimate maintenance windows stopping individual services (investigate volume and parent process)
  - Software installers during upgrades
level: high
---
title: Unauthorized RMM Tool Installation Consistent with Ransomware Staging
id: c3d7f1a9-5b2e-4e8c-91a4-6d0b3f7e2a58
status: experimental
description: Detects execution of remote monitoring and management tools (AnyDesk, ScreenConnect, Splashtop) from non-standard locations, a common Qilin affiliate persistence and access technique.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - '\anydesk'
      - '\screenconnect'
      - '\splashtop'
  selection_path:
    Image|contains:
      - '\temp\'
      - '\appdata\local\temp\'
      - '\users\public\'
      - '\programdata\'
      - '\downloads\'
  condition: selection_img and selection_path
falsepositives:
  - Organizations that legitimately deploy these RMM tools — baseline approved install paths and filter accordingly
level: medium

let Lookback = 7d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where (FileName in~ ("vssadmin.exe", "wmic.exe") and ProcessCommandLine has_any ("delete shadows", "shadowcopy delete"))
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
    or (FileName in~ ("net.exe", "net1.exe", "sc.exe") and ProcessCommandLine has_any ("stop veeam", "stop sql", "stop mssql", "stop backup", "stop vss", "stop exchange"))
    or (FileName =~ "wevtutil.exe" and ProcessCommandLine has "cl")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by DeviceName asc, TimeGenerated asc

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("anydesk", "screenconnect", "splashtop")
    or FileName has_any ("anydesk", "screenconnect", "splashtop")
| where FolderPath has_any ("\\temp\\", "\\users\\public\\", "\\downloads\\", "\\programdata\\")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), UserList=make_set(AccountName) by DeviceName, FileName, FolderPath
| order by FirstSeen asc

-- Hunt for pre-encryption sabotage process execution and Qilin-style ransom notes
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures|stop veeam|stop sql|stop backup)'
   OR Exe =~ '(?i)(anydesk|screenconnect|splashtop)'

-- Sweep user profiles and public directories for ransom note artifacts
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/*/RECOVER*', accessor='file')
UNION ALL
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/Public/*/RECOVER*', accessor='file')

# Verify VSS protection is intact and shadow copies exist
Write-Host "=== Shadow Copy Status ===" -ForegroundColor Cyan
Get-CimInstance Win32_ShadowCopy | Select-Object DeviceObject, InstallDate, VolumeName
vssadmin list shadows

# Verify recovery boot settings have not been sabotaged
Write-Host "=== Boot Recovery Settings ===" -ForegroundColor Cyan
bcdedit /enum {current} | Select-String -Pattern "recoveryenabled|bootstatuspolicy"

# Audit for RMM tools running from suspicious paths
Write-Host "=== RMM Tool Audit ===" -ForegroundColor Cyan
Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match "anydesk|screenconnect|splashtop" -and
    $_.ExecutablePath -match "Temp|Public|Downloads|ProgramData"
} | Select-Object ProcessId, Name, ExecutablePath, CommandLine

# Audit for recently created suspicious services (PsExec-style staging)
Write-Host "=== Recent Suspicious Services ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match "PSEXESVC|ADMIN\$|Temp" -or $_.Name -match "PAExec|RemCom"
} | Select-Object Name, State, PathName, StartName

# Confirm critical backup services are running and monitored
Write-Host "=== Backup Service Health ===" -ForegroundColor Cyan
Get-Service | Where-Object { $_.DisplayName -match "Veeam|Backup|Sophos|Sense" } |
    Select-Object Name, DisplayName, Status, StartType