Potential Raspberry Robin Dot Ending File Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects command-line executions where a file path ends with a period (e.g., 'file.exe.'). This technique has been observed in campaigns associated with the Raspberry Robin worm to potentially evade detection or confuse users.