QILIN Ransomware: Legal Sector Under Siege — 15 Victims Posted & Critical Check Point CVE Exploited

title: Potential Check Point VPN IKEv1 Exploitation Attempt
description: Detects potential exploitation of CVE-2026-50751 involving abnormal IKEv1 key exchange patterns or subsequent suspicious process execution on the gateway. Note: Requires VPN gateway logs or endpoint logs on management servers.
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
date: 2026/06/11
status: experimental
logsource:
    category: firewall
    product: checkpoint
detection:
    selection:
        service|contains: 'ike'
        action: 'accept' or 'decrypt' or 'encrypt'
        vpn_type|contains: 'ikev1'
    filter_main_legit:
        src_ip|cidr:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
            - '172.16.0.0/12'
    condition: selection and not filter_main_legit
falsepositives:
    - Legacy VPN configurations requiring IKEv1 from known trusted IPs
level: high

title: Suspicious ScreenConnect Child Process (CVE-2024-1708)
description: Detects suspicious processes spawned by ConnectWise ScreenConnect service, indicative of authenticated RCE exploitation.
references:
    - https://attack.mitre.org/techniques/T1210/
author: Security Arsenal Research
date: 2026/06/11
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\ScreenConnect.Service.exe'
    selection_img:
        - Image|endswith: '\cmd.exe'
        - Image|endswith: '\powershell.exe'
        - Image|endswith: '\powershell_ise.exe'
        - Image|endswith: '\pwsh.exe'
        - Image|endswith: '\mshta.exe'
        - Image|endswith: '\regsvr32.exe'
        - Image|endswith: '\rundll32.exe'
    condition: selection_parent and selection_img
falsepositives:
    - Legitimate administrative use via ScreenConnect (rare for cmd.exe/powershell.exe to be direct children)
level: critical

title: Ransomware Shadow Copy Deletion via VssAdmin
description: Detects attempts to delete Volume Shadow Copies using vssadmin.exe, a common precursor to Qilin encryption to prevent recovery.
references:
    - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal Research
date: 2026/06/11
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    condition: selection
falsepositives:
    - System administration tasks (rare)
level: high

// Hunt for large scale file encryption patterns often seen in Qilin attacks
// Looks for rapid modification of file extensions in short timeframes
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType == "FileCreated" or ActionType == "FileModified"
| extend Extension = tostring(split(FileName, '.')[ -1 ])
| project Timestamp, DeviceName, FolderPath, FileName, Extension, InitiatingProcessAccountName
| summarize Count = count(), UniqueExtensions = dcount(Extension) by DeviceName, bin(Timestamp, 5m)
| where Count > 50 and UniqueExtensions > 10 // Heuristic threshold
| order by Count desc

<#
.SYNOPSIS
    Qilin Response Check - Identifies signs of compromise and ransomware staging.
.DESCRIPTION
    Checks for recent shadow copy deletion, suspicious scheduled tasks, and large archive creation.
#>

Write-Host "[+] Starting Qilin Response Check..." -ForegroundColor Cyan

# 1. Check for VssAdmin deletion events in last 24 hours
Write-Host "\n[*] Checking for Shadow Copy Deletion attempts (Last 24h)..." -ForegroundColor Yellow
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4674; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
             Where-Object { $_.Message -match 'vssadmin' -and $_.Message -match 'delete' }
if ($vssEvents) { $vssEvents | Select-Object TimeCreated, Message } 
else { Write-Host "No explicit VssAdmin deletion events found in Security Log." -ForegroundColor Green }

# 2. Check for recently created Scheduled Tasks (Common persistence)
Write-Host "\n[*] Checking for Scheduled Tasks created in last 7 days..." -ForegroundColor Yellow
$schtasks = schtasks /query /fo LIST /v | Select-String "TaskName","Scheduled For","Author" | 
             Out-String | ConvertFrom-String -Delimiter ":" 
# Note: Parsing schtasks output is complex; basic check via XML export is better for admins but this is a quick triage.
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } | 
    Select-Object TaskName, Date, Author, Action | Format-Table -AutoSize

# 3. Check for RAR/7z processes in last 24h (Staging)
Write-Host "\n[*] Checking for Archiving Processes (WinRAR/7zip) in last 24h..." -ForegroundColor Yellow
$proc = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=1; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue |
         Where-Object { $_.Message -match 'winrar.exe' -or $_.Message -match '7z.exe' -or $_.Message -match 'rar.exe' }
if ($proc) { $proc | Select-Object TimeCreated, Message } 
else { Write-Host "No archiving tool activity detected via Sysmon." -ForegroundColor Green }

Write-Host "\n[+] Triage Complete." -ForegroundColor Cyan


---