Qilin Ransomware Expands Post-Compromise Reconnaissance

Researchers observed the Qilin RaaS group deploying a stealthy post-compromise reconnaissance technique: a PowerShell query of Event ID 1149 in the Windows Terminal Services operational log to enumerate RDP authentication history (usernames, domains, source IPs) and quickly map privileged accounts for lateral movement. The report warns this living-off-the-land approach evades noisy scans and advises defenders to enable PowerShell ScriptBlock Logging and monitor for the specific log-extraction queries and other advanced PowerShell activity.