---
title: Potential Qilin Ransomware PowerShell Launcher
id: 4a8b8c9d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
description: Detects suspicious PowerShell execution patterns often used by Qilin affiliates to load payloads, specifically base64 encoded strings combined with suspicious window styles.
status: experimental
date: 2026/06/15
author: Security Arsenal Research
references:
    - https://securityarsenal.com/darkside
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1027
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains:
            - ' -enc '
            - ' -encodedcommand '
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: Suspicious Rclone Execution for Exfiltration
description: Detects the execution of rclone.exe, a tool frequently used by Qilin for data exfiltration to cloud storage prior to encryption.
status: experimental
date: 2026/06/15
author: Security Arsenal Research
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\rclone.exe'
        CommandLine|contains:
            - 'copy'
            - 'sync'
            - 'config create'
    condition: selection
falsepositives:
    - Authorized use by backup administrators
level: critical
---
title: Lateral Movement via PsExec and SMB
description: Identifies the use of PsExec or similar administrative tools for lateral movement, a common tactic for Qilin affiliates to spread across the network.
status: experimental
date: 2026/06/15
author: Security Arsenal Research
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\psexec.exe'
        - Image|endswith: '\psexec64.exe'
    selection_cli:
        CommandLine|contains:
            - '\\'
            - '-accepteula'
    condition: all of selection_*
falsepositives:
    - IT Administration tasks
level: high

// Hunt for signs of Qilin lateral movement and mass file access
// Looks for pattern of access to administrative shares and potential service installation
SecurityEvent
| where EventID in (5140, 5145, 4624, 4625)
| where ShareName in ("ADMIN$", "IPC$", "C$")
| extend Account = tostring(split(TargetUserName, '\\')[-1]), Computer = tostring(split(ComputerName, '.')[0])
| summarize Count = count() by EventID, Account, Computer, TargetUserName
| where Count > 5 // Filter noise
| project TimeGenerated, EventID, Account, Computer, TargetUserName, Count
| order by TimeGenerated desc

<#
.SYNOPSIS
    Qilin Ransomware Rapid Response Check
.DESCRIPTION
    Checks for common Qilin persistence mechanisms and indicators of compromise (IOCs) including recent scheduled tasks and VSS shadow copy manipulation.
#>

Write-Host "[+] Starting Qilin Ransomware IOC Check..." -ForegroundColor Cyan

# 1. Check for recently created Scheduled Tasks (Common Persistence)
Write-Host "[!] Checking for Scheduled Tasks created in the last 7 days..." -ForegroundColor Yellow
$dateThreshold = (Get-Date).AddDays(-7)
Get-ScheduledTask | Where-Object {$_.Date -gt $dateThreshold} | Select-Object TaskName, TaskPath, Date, Author | Format-Table -AutoSize

# 2. Check Volume Shadow Copy Status (Qilin deletes them)
Write-Host "[!] Checking Volume Shadow Copy Storage..." -ForegroundColor Yellow
try {
    $vss = vssadmin list shadows
    if ($vss -match "No shadows found") {
        Write-Host "[CRITICAL] No Volume Shadow Copies found. Possible deletion event." -ForegroundColor Red
    } else {
        Write-Host "[OK] Volume Shadow Copies exist." -ForegroundColor Green
    }
} catch {
    Write-Host "[ERROR] Could not query VSS." -ForegroundColor Red
}

# 3. Check for processes associated with Rclone or AnyDesk
Write-Host "[!] Checking for suspicious tooling processes..." -ForegroundColor Yellow
$procs = @("rclone", "anydesk", "screenconnect", "chrome_remote_desktop")
foreach ($p in $procs) {
    if (Get-Process -Name $p -ErrorAction SilentlyContinue) {
        Write-Host "[WARNING] Process '$p' is active." -ForegroundColor Red
    }
}

Write-Host "[+] Check Complete. If critical warnings found, isolate host immediately." -ForegroundColor Cyan


---

# Incident Response Priorities

**T-Minus Detection Checklist:**
1.  **Phishing Link Analysis:** Review O365 email logs for macro-enabled documents received 3-7 days prior.
2.  **VPN Logs:** Inspect VPN authentication logs for successful logins from anomalous geolocations (specifically check for logins matching KR, MX, ES regions for US-based orgs).
3.  **Service Creation:** Hunt for Event ID 7045 (New Service Created) with unusual service names or binary paths.

**Critical Assets Prioritized for Exfiltration:**
*   **Legal Case Files:** Qilin specifically targets firms like Miller & Zois; M&A data and client PII are top exfiltration targets.
*   **Financial Records:** Accounts payable/receivable databases.
*   **HR Data:** Employee SSNs and tax forms.

**Containment Actions (Ordered by Urgency):**
1.  **Isolate:** Disconnect infected hosts from the network immediately; do not shutdown (preserve memory artifacts).
2.  **Disable Accounts:** Suspend service accounts and admin credentials used on the affected segment.
3.  **Block Storage:** Egress firewall rules blocking access to cloud storage APIs ( Dropbox, Google Drive, MEGA) commonly used with Rclone.

---

# Hardening Recommendations

**Immediate (24h):**
*   **MFA Enforcement:** Enforce strict MFA (FIDO2/WebAuthn) on all VPN, Remote Desktop, and Email portals.
*   **Phishing Filters:** Update email gateway rules to block macro-enabled documents or force them to a sandbox environment.
*   **RDP Blocking:** Block inbound RDP (TCP 3389) from the internet at the perimeter firewall.

**Short-term (2 weeks):**
*   **Network Segmentation:** Segment Legal/Professional Services file servers from the general network to prevent lateral movement.
*   **Endpoint Detection:** Deploy or update EDR signatures specifically looking for Cobalt Strike beacons and the Qilin Go-malloc payload behavior.
*   **Access Review:** Revoke local admin rights for all standard users and implement Just-In-Time (JIT) access for administrators.