Qilin Ransomware aka Agenda – Active IOCs Detection

Chaitanya B B@mralien

•updated Aug 1, 2025•7•5•265

This rule detects files associated with Qilin (aka Agenda) ransomware based on known malicious file hashes. It monitors for file creation or process execution events where the SHA1, SHA256, or MD5 hash matches a predefined list of Qilin ransomware hashes.