Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
11
10
4
2
Contributors
12
11
4
Categories
14
13
6
5
2
Platforms
27
1
Products / Services
9
4
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the execution of wscript.exe, msiexec.exe, or cmd.exe initiated with command lines pointing to script files (.js, .vbs) or shortcut files (.lnk) located on removable drives (d-z drive letters). This behavior is characteristic of the Raspberry Robin worm spreading via infected USB media.
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
Detects the execution of wscript.exe, msiexec.exe, or cmd.exe initiated with command lines pointing to script files (.js, .vbs) or shortcut files (.lnk) located on removable drives (d-z drive letters). This behavior is characteristic of the Raspberry Robin worm spreading via infected USB media.
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
Detects potential sideloading of malicious "aclui.dll" by OleView. This behavior was observed in Raspberry-Robin variants reported by Checkpoint Research in February 2024. The rule specifically looks for OleView.exe loading aclui.dll, while filtering out known legitimate paths and signed executables to reduce false positives.
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Detects the usage of msiexec.exe to perform a quiet installation of a package from a remote location (either HTTP/HTTPS or a UNC path). This behavior is often associated with malware distribution, including the Raspberry Robin worm, to evade detection and establish persistence.
Detects suspicious calls to the "ShellExec_RunDLL" exported function of SHELL32.DLL using an ordinal number to launch other commands. Adversaries might use ordinal numbers to bypass detections that rely on the function name in the command line. The rule looks for specific ordinal numbers associated with ShellExec_RunDLL and combines this with suspicious parent command-line arguments (e.g., containing 'comspec', 'iex', 'Invoke-', or paths like 'Temp') or suspicious child processes (e.g., bash, cmd, powershell, bitsadmin, msiexec).
Detects the initial execution of the Raspberry Robin malware from an external drive. The rule specifically looks for `cmd.exe` as a parent process, executing a command containing `/r` and ending with specific file extensions (like .bin, .ico, .lnk, .lo, .sv, .usb), which then launches `msiexec.exe` with `/q` and a URL (http: or https:). This pattern is indicative of Raspberry Robin's initial infection vector.
Page 1 of 2