Qilin Ransomware

index=vpn_logs action=success
| iplocation src_ip
| stats dc(Country) as country_count, values(Country) as countries by user
| where country_count > 1
| sort -country_count

index=veeam_logs (action="JobDeleted" OR action="JobDisabled" OR action="TapeDeleted")
| stats count by action, job_name, user
| sort -count

index=windows sourcetype=WinEventLog:Security
(CommandLine="*vssadmin*delete*" OR CommandLine="*wmic*shadowcopy*delete*")
| stats count by ComputerName, User, CommandLine

DeviceFileEvents
| where FolderPath has "\\Google\\Chrome\\User Data\\"
| where FileName in ("Login Data", "Cookies", "Web Data")
| where InitiatingProcessFileName !in ("chrome.exe", "GoogleUpdate.exe")
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName

DeviceEvents
| where ActionType == "DriverLoad"
| where FileName in~ ("dark.sys", "eskle.sys", "procexp.sys", "gdrv.sys", "dbutil_2_3.sys")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256

DeviceRegistryEvents
| where RegistryKey has "SecurityProviders\\WDigest"
| where RegistryValueName == "UseLogonCredential"
| where RegistryValueData == "1"
| project Timestamp, DeviceName, RegistryKey, InitiatingProcessFileName

title: Qilin Chrome Credential Harvesting via GPO
id: INT-QILIN-001
status: experimental
description: Detects Chrome credential access from GPO logon scripts
logsource:
    category: file_access
    product: windows
detection:
    chrome_data:
        TargetFilename|contains: '\Google\Chrome\User Data\'
        TargetFilename|endswith:
            - 'Login Data'
            - 'Cookies'
    suspicious_process:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
    condition: chrome_data and suspicious_process
level: high

title: Qilin BYOVD EDR Killer Detection
id: INT-QILIN-002
status: experimental
description: Detects vulnerable drivers used by Qilin for EDR evasion
logsource:
    category: driver_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\dark.sys'
            - '\eskle.sys'
            - '\gdrv.sys'
    condition: selection
level: critical