Threat video1:00
Qilin (Agenda) March vs October Variants: Detection & IOCs
Qilin's October 2026 build carries a forged Microsoft signature and VMware ESXi attack scripts. 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Qilin (Agenda) March vs October Variants: Detection & IOCs →
Chapters
- 0:00The hookOctober Qilin ransomware: forged, modular, spreading.
- 0:04The storyMarch version: manual, unsigned.
- 0:10Attack pathForged Microsoft signature masquerades as Windows Resource Monitor.
- 0:26AttributionAttributed to Qilin RaaS.
- 0:30Indicators of compromise6 indicators to hunt: 1 domain, 2 file names and 1 registry key, and more.
- 0:37MITRE ATT&CK techniques17 ATT&CK techniques, from execution to impact.
- 0:41Remediation5 steps now: Hunt for resmon.exe running outside C:\Windows\System32 or with an invalid.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00October Qilin ransomware: forged, modular, spreading.
0:05March version: manual, unsigned.
0:07October brings forged signatures, auto spread.
0:11Forged Microsoft signature masquerades as Windows Resource Monitor.
0:15Token duplication spreads PsExec across sessions.
0:19Safe Mode disables EDR.
0:21Files, VMs encrypted; ransom notes left.
0:27Attributed to Qilin RaaS. Confidence: medium.
0:316 indicators to hunt: 1 domain, 2 file names and 1 registry key, and more.
0:3717 ATT&CK techniques, from execution to impact.
0:425 steps now: Hunt for resmon.exe running outside C:\Windows\System32 or with an invalid.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.