Qilin (Agenda) — Ransomware-as-a-Service Hunt & Hardening Pack

Looks for: built-in AD enumeration post-compromise. Accomplishes: earliest reliable signal — pair with an interactive VPN logon (N2). FP: sysadmin/helpdesk scripts — allow-list admin AIDs / PAW.

// HUNT: Qilin AD discovery (T1087.002 / T1018 / T1482)
// CONF: medium  FP: medium  COST: low | TIMEFRAME: last 7d
// FP NOTES: net.exe by admins from PAW/JIT; nltest in AD health scripts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| in(field=FileName, values=["net.exe","net1.exe","nltest.exe","dsquery.exe","adfind.exe","whoami.exe"], ignoreCase=true)
| CommandLine=/(group\s+"?Domain Admins"?|group\s+"?Enterprise Admins"?|\/dclist|\/domain_trusts|Get-ADComputer|Get-ADUser)/i
| groupBy([aid, ComputerName, UserName], function=[count(), collect([FileName, CommandLine], limit=20)])
| sort(_count, order=desc)

Looks for: the embedded-PsExec command pattern (randomized binary name, UNC target, copy-and-run flags). Accomplishes: catches the encryptor spreading over SMB — impact imminent. FP: sanctioned PsExec deploys — allow-list known admin tooling/AIDs.

// HUNT: Qilin encryptor self-propagation via embedded PsExec (T1021.002, T1570)
// CONF: high  FP: low  COST: low | ENV EDIT: allow-list sanctioned PsExec admin AIDs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/-accepteula\s+\\\\[^\s]+\s+-c\s+-f\s+-h\s+-d/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: VSS deletion / recovery-inhibition commands. Accomplishes: the "impact imminent" signal — escalate immediately. FP: rare admin maintenance — alert regardless and verify.

// HUNT: Qilin recovery inhibition (T1490)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/vssadmin(\.exe)?\s+delete\s+shadows|wmic\s+shadowcopy\s+delete|win32_shadowcopy.{0,20}delete|bcdedit.{0,40}recoveryenabled\s+no|wbadmin\s+delete\s+catalog|cipher\s+\/w:/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: bulk event-log clearing via wevtutil/Get-WinEvent/Clear-EventLog. Accomplishes: catches the forensic-obstruction stage. FP: very rare legit clears — alert and verify.

// HUNT: Qilin event-log clearing (T1070.001)
// CONF: high  FP: low  COST: low | pair with native Security 1102 / System 104
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(wevtutil(\.exe)?\s+(cl|clear-log)|Clear-EventLog|Get-WinEvent.{0,40}-ListLog.{0,40}(ClearLog|RecordCount)|Limit-EventLog.{0,20}-OverflowAction)/i
| table([@timestamp, aid, ComputerName, UserName, CommandLine], limit=200)

Looks for: fsutil behavior set SymlinkEvaluation R2R:1 / R2L:1 — a tell-tale Qilin step. Accomplishes: high-fidelity, near-zero FP. FP: none expected — alert on any hit.

// HUNT: Qilin enabling remote symlink evaluation (T1222 / evasion)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/fsutil\s+behavior\s+set\s+SymlinkEvaluation\s+R2(R|L):1/i
| table([@timestamp, aid, ComputerName, UserName, CommandLine, ParentBaseFileName], limit=200)

Looks for: comsvcs.dll MiniDump of LSASS or Mimikatz-style command lines. Accomplishes: the credential-theft stage. FP: some IR/EDR tooling dumps LSASS — allow-list sanctioned tools. (Falcon CredTheft IOAs also fire here.)

// HUNT: Qilin LSASS credential theft (T1003.001)
// CONF: high  FP: low-med  COST: low | TUNING: allow-list sanctioned IR/EDR dumpers
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(comsvcs\.dll.{0,20}MiniDump|sekurlsa|lsadump|privilege::debug|rundll32.{0,30}lsass|procdump.{0,20}lsass|nanodump)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine], limit=200)

Looks for: the encryptor binary from C:\temp, its -spread-vcenter flag, or the MaxMpxCt tuning. Accomplishes: the encryption stage. FP: low — verify any hit immediately.

// HUNT: Qilin encryptor execution / vCenter spread / SMB tuning (T1486, T1570)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (ImageFileName=/\\(Temp|temp)\\w\.exe$/i
   or CommandLine=/-spread-vcenter|-no-vm-snapshot|--password\s+[A-Fa-f0-9]{64}/i
   or CommandLine=/reg(\.exe)?\s+add.{0,40}MaxMpxCt/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine], limit=200)