Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Qilin – Nmap/Nping Scan Followed by NetExec Credential Spray

Qilin Lateral Movement Sentinel
MITRE ATT&CK
Network Service Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (qilin)
What This Detects
Separately from its BYOVD EDR-kill chain, Qilin runs Nmap/Nping network sweeps and then pivots to NetExec (CrackMapExec successor) for credential spraying/lateral movement — the two in sequence on one host is a strong signal.
Query
let scan = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("nmap.exe","nping.exe")
| project DeviceName, ScanTime = Timestamp;
let spray = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has "netexec" or ProcessCommandLine has_any ("nxc smb","nxc winrm")
| project DeviceName, SprayTime = Timestamp;
scan
| join kind=inner spray on DeviceName
| where SprayTime - ScanTime between (0min .. 4h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.