Threat Analysis: LockBit5 and Qilin Target Italian Manufacturing — Detection and Defense Strategies

---
title: Potential Ransomware Shadow Copy Deletion
id: 9a5a3c12-d1b4-4f8a-9e6b-1c2d3e4f5a6b
status: experimental
description: Detects attempts to delete volume shadow copies, a common precursor to encryption by LockBit5 and Qilin to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'Remove-WmiObject'
  condition: selection
falsepositives:
  - Legitimate system administration tasks (rare)
level: high
---
title: Suspicious PowerShell EncodedCommand Pattern
id: b2b4c6d8-e7f9-4a1b-8c3d-0e1f2a3b4c5d
status: experimental
description: Detects highly obfuscated PowerShell commands often used by Qilin for initial execution and defense evasion.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_obfu:
    CommandLine|contains: 'EncryptedCommand'
  selection_length:
    CommandLine|re: '^.*\s+[A-Za-z0-9+/]{100,}={0,2}\s*$'
  condition: all of selection_*
falsepositives:
  - Legitimate software installation scripts
level: medium
---
title: Mass File Encryption Indicator via Ransomware Extensions
id: c3d4e5f6-8a9b-4c2d-1e3f-4a5b6c7d8e9f
status: experimental
description: Detects rapid modification of file extensions indicative of LockBit5 or Qilin encryption processes.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '.lockbit5'
      - '.qilin'
  timeframe: 5m
  condition: selection | count() > 10
falsepositives:
  - Unknown
level: critical

// Hunt for suspicious processes deleting shadow copies and stopping services
// Common behavior in LockBit5 and Qilin campaigns prior to encryption
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "shadowstorage")
   or ProcessCommandLine has_any ("stop-service", "Set-Service -StartupType Disabled")
| where FileName in~ ("vssadmin.exe", "wmic.exe", "powershell.exe", "cmd.exe", "net.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
| order by Timestamp desc

-- Hunt for processes exhibiting ransomware behavior characteristics
-- Specifically looking for processes touching a high number of distinct files rapidly
LET FileMods = SELECT FileName, FullPath, Mtime
FROM glob(globs="**/*", root=PathSpec(OSPath="C:\\Users"))
WHERE Mtime > now() - INTEGER(minute=30)

SELECT count(Name) AS FileCount, Name, Pid, CommandLine
FROM pslist()
WHERE Pid in (SELECT Pid FROM process_tracking(pid=FileMods.Pid))
GROUP BY Name, Pid, CommandLine
HAVING FileCount > 50

# Emergency Hardening Script for Ransomware Response
# Disables vulnerable protocols and checks for common persistence mechanisms used by LockBit/Qilin

# 1. Disable SMBv1 (if not already disabled) to restrict lateral movement
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# 2. Disable Remote Desktop Protocol if not strictly required
# (Manufacturing environments often leave RDP open for vendors)
$RDPRegistry = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server"
if ((Get-ItemProperty -Path $RDPRegistry).fDenyTSConnections -ne 1) {
    Set-ItemProperty -Path $RDPRegistry -Name "fDenyTSConnections" -Value 1
    Write-Host "[!] RDP has been disabled for hardening."
}

# 3. Audit Scheduled Tasks for suspicious OBFS execution
Get-ScheduledTask | Where-Object {$_.State -eq 'Ready'} | ForEach-Object {
    $Action = $_.Actions.Execute
    if ($Action -match "powershell" -or $Action -match "wscript") {
        Write-Host "[WARN] Suspicious Scheduled Task Found: $($_.TaskName) - Action: $Action"
    }
}

Write-Host "[+] Hardening audit complete. Review warnings immediately."