QILIN Ransomware: Surge in Manufacturing & Healthcare Targeting via Critical CVE Exploits

---
title: Potential ConnectWise ScreenConnect Path Traversal Exploitation
id: 9e70f604-4a5d-4d83-9c7a-1234567890ab
description: Detects potential exploitation of CVE-2024-1708 against ConnectWise ScreenConnect via suspicious URI patterns
status: experimental
date: 2026/05/18
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '/App_Extensions'
            - '/Setup/'
    filter:
        cs-method|contains: 'POST'
    condition: selection and filter
falsepositives:
    - Legitimate administrative access
level: critical
---
title: SmarterMail Unrestricted File Upload Exploitation
id: b1f2c3d4-e5f6-4a5b-8c9d-0123456789ab
description: Detects suspicious file upload attempts on SmarterMail servers indicative of CVE-2025-52691 exploitation
status: experimental
date: 2026/05/18
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal Research
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ShareName|contains: 'Mails'
        RelativeTargetName|contains:
            - '.aspx'
            - '.ashx'
    condition: selection
falsepositives:
    - Rare administrative file management
level: high
---
title: Suspicious PowerShell Encoded Command Execution via RDP
id: c2d3e4f5-a6b7-4c8d-9e0f-234567890abc
description: Detects base64 encoded PowerShell commands executed shortly after an RDP session, common in Qilin manual
date: 2026/05/18
status: experimental
author: Security Arsenal Research
logsource:
    product: windows
    service: security
detection:
    selection_rdp:
        EventID: 4624
        LogonType: 10
    selection_powershell:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains: ' -enc ' or CommandLine|contains: ' -EncodedCommand '
    timeframe: 1m
    condition: selection_rdp | followed by selection_powershell
falsepositives:
    - Administrative scripts run via RDP
level: high


kql
// KQL Hunt for Lateral Movement and Staging
// Hunt for large file transfers to non-standard shares and SMB execution
let TimeFrame = 1h;
SecurityEvent
| where TimeGenerated > ago(TimeFrame)
| where EventID in (5140, 5145) // File Share Access
| where SubjectUserName != "*$" // Filter out computer accounts mostly
| where RelativeTargetName !contains ".tmp" 
| where FileLength > 10485760 // Greater than 10MB
| project TimeGenerated, Computer, SubjectUserName, ShareName, RelativeTargetName, FileLength, SourceIpAddress
| join kind=inner (
    SecurityEvent 
    | where EventID == 4624 and LogonType == 3 or LogonType == 10
    | project TimeGenerated, TargetUserName, IpAddress
) on $left.SourceIpAddress == $right.IpAddress, $left.TimeGenerated between ($right.TimeGenerated-5m .. $right.TimeGenerated+5m)
| distinct TimeGenerated, Computer, SubjectUserName, ShareName, RelativeTargetName, IpAddress


powershell
# Qilin Response Script: Check for Persistence and Shadow Copy Deletion
# Run with elevated privileges

Write-Host "Checking for Qilin Indicators of Persistence..." -ForegroundColor Cyan

# 1. Check for Scheduled Tasks created in last 24 hours (Common Qilin persistence)
$schTasks = Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-1)}
if ($schTasks) {
    Write-Host "[ALERT] Suspicious Scheduled Tasks found created in last 24h:" -ForegroundColor Red
    $schTasks | Select-Object TaskName, Author, Date, Action
} else {
    Write-Host "[OK] No recent scheduled tasks found." -ForegroundColor Green
}

# 2. Check for Volume Shadow Copy Depletion attempts (Vssadmin)
$events = Get-WinEvent -LogName Application -FilterXPath "*[System[(EventID=123)]]" -ErrorAction SilentlyContinue
if ($events) {
    $recentVssErrors = $events | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-2)}
    if ($recentVssErrors) {
        Write-Host "[ALERT] Recent VSS Admin errors (Shadow Copy deletion attempts) detected." -ForegroundColor Red
    }
}

# 3. Check for unusual processes named common Qilin ransomware names
$suspiciousProcs = @("encryptor", "locker", "qilin", "agenda")
$procs = Get-Process | Where-Object {$suspiciousProcs -like $_.ProcessName}
if ($procs) {
    Write-Host "[CRITICAL] Suspicious encryption process running:" -ForegroundColor Red
    $procs | Select-Object ProcessName, Id, Path
}