QILIN Ransomware: Surge in Construction & Service Sector Attacks — Detection & Intel Brief

title: Potential Qilin ScreenConnect Webshell Activity CVE-2024-1708
id: 9c8e2a1d-f4e5-4c88-9b12-a5c0d3f8e9a1
description: Detects potential webshell activity or suspicious authentication bypass patterns associated with CVE-2024-1708 on ConnectWise ScreenConnect servers.
status: experimental
date: 2026/05/21
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140 or 5145
        ShareName|contains: 'ScreenConnect'
        RelativeTargetName|contains: 
            - 'Web.config'
            - '.aspx'
            - '.ashx'
    condition: selection
falsepositives:
    - Legitimate administrative updates
level: high

tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.1708
    - ransomware.qilin

---

title: SmarterMail Unrestricted File Upload Exploitation Attempt
id: b7d3e4f1-2a6c-4d8b-9e0f-1a2b3c4d5e6f
description: Detects suspicious file upload patterns or authentication bypass indicators associated with SmarterMail CVE-2025-52691 exploited by Qilin affiliates.
status: experimental
date: 2026/05/21
author: Security Arsenal Research
logsource:
    product: web server
detection:
    selection_uri:
        cs-uri-query|contains: 
            - 'aspx/\.asmx'
            - 'Services/Mail.asmx'
    selection_method:
        cs-method: 'POST'
    selection_ext:
        cs-uri-query|contains: 
            - '.dll'
            - '.aspx'
            - '.ashx'
    condition: all of selection_*
falsepositives:
    - Legitimate SmarterMail API usage
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.52691
    - ransomware.qilin

---

title: Qilin Ransomware Process Execution Patterns
description: Detects suspicious process execution patterns consistent with Qilin ransomware activity, including disabling of security services and shadow copy deletion.
status: experimental
date: 2026/05/21
author: Security Arsenal Research
logsource:
    category: process_creation
detection:
    selection_vss:
        CommandLine|contains: 'delete shadows /all /quiet'
    selection_backup:
        Image|endswith: 
            - '\\wbadmin.exe'
            - '\\veeam.exe'
        CommandLine|contains: 'delete'
    selection_qilin_crypto:
        Image|endswith: '.exe'
        CommandLine|contains: '-m crypto' # Observed in some Qilin variants
    condition: 1 of selection_*
falsepositives:
    - Legitimate system administration
level: critical
tags:
    - attack.impact
    - attack.t1486
    - ransomware.qilin

// Hunt for lateral movement and staging indicative of Qilin pre-encryption
DeviceProcessEvents  
| where Timestamp >= ago(7d)  
// Look for common tools used by Qilin for lateral movement
| where FileName in~ (\"psexec.exe\", \"psexec64.exe\", \"wmic.exe\", \"powershell.exe\", \"cmd.exe\") 
// Filter for suspicious command line arguments
| where ProcessCommandLine has_any (\"-i\", \"-s\", \"-accepteula\", \"process call\", \"create\", \"Invoke-Expression\", \"IEX\") 
// Correlate with network connections to non-standard ports
| join kind=inner (DeviceNetworkEvents  
    | where Timestamp >= ago(7d)  
    | where RemotePort in (445, 135, 139, 3389, 5985, 5986)  
    | summarize Count=count() by DeviceId, RemoteIP, RemotePort  
    | where Count > 10) on DeviceId  
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessFileName

# Qilin Response Hardening: Audit Scheduled Tasks and Web Shells
# Run as Administrator

Write-Host \"[+] Initiating Qilin Hardening Audit...\" -ForegroundColor Cyan

# 1. Check for recently modified Scheduled Tasks (common for persistence)
Write-Host \"[*] Checking for Scheduled Tasks modified in the last 7 days...\" -ForegroundColor Yellow
$dateThreshold = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object { $_.Date -gt $dateThreshold } | Select-Object TaskName, Date, Author, Actions | Format-Table -AutoSize

# 2. Scan for suspicious ASPX/ASHX files in web roots (SmarterMail/ScreenConnect webshell indicators)
Write-Host \"[*] Scanning common web directories for recently created web shells (ASPX/ASHX)...\" -ForegroundColor Yellow
$webPaths = @(
    \"C:\\inetpub\\wwwroot\",
    \"C:\\Program Files\\ConnectWise\\ScreenConnect\",
    \"C:\\Program Files (x86)\\SmarterTools\\SmarterMail\"
)

foreach ($path in $webPaths) {
    if (Test-Path $path) {
        Write-Host \"Scanning $path...\" -ForegroundColor Gray
        Get-ChildItem -Path $path -Recurse -Include *.aspx, *.ashx, *.asmx -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt $dateThreshold -and $_.Length -lt 50kb } |
        Select-Object FullName, LastWriteTime, Length
    }
}

Write-Host \"[+] Audit Complete.\" -ForegroundColor Green


---