Potential Raspberry Robin CPL Execution via Rundll32

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•21

Detects the execution of a Control Panel (.CPL) file located in the user's temporary directory via the Shell32 DLL's "Control_RunDLL" export function. This behavior has been observed in multiple Raspberry Robin malware variants.