Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
11
10
4
2
Contributors
12
11
4
Categories
14
13
6
5
2
Platforms
27
1
Products / Services
9
4
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects the subsequent execution of commands associated with Raspberry Robin malware. Specifically, it looks for processes where 'fodhelper.exe' is the parent process, and the child process is either 'rundll32.exe' or 'regsvr32.exe'. Additionally, the command line of the child process must contain specific strings like 'odbcconf.exe', 'regsvr', 'shellexec_rundll', and other keywords such as 'installdriver', 'setfiledsndir', or 'vkipdse', combined with specific command-line switches like '/a', '/f', or '/s'. This combination of parent-child processes and command-line arguments is indicative of Raspberry Robin's post-exploitation activities, often involving the abuse of legitimate Windows utilities for defense evasion and execution.
Detects the execution of a Control Panel (.CPL) file located in the user's temporary directory via the Shell32 DLL's "Control_RunDLL" export function. This behavior has been observed in multiple Raspberry Robin malware variants.
Detects suspicious usage of the ShellExec_RunDLL function to launch other commands, as observed in the Raspberry Robin attack. This rule specifically looks for 'ShellExec_RunDLL' in the command line combined with suspicious paths or commands like 'Desktop', 'Temp', 'Users\Public', 'comspec', 'iex', 'Invoke-', 'msiexec', 'odbcconf', or 'regsvr32'.
Detects command-line executions where a file path ends with a period (e.g., 'file.exe.'). This technique has been observed in campaigns associated with the Raspberry Robin worm to potentially evade detection or confuse users.
Detects suspicious network connections initiated by specific Windows binaries (regsvr32.exe, rundll32.exe, dllhost.exe) when they are executed without any command-line parameters. This behavior can indicate an attempt to evade detection by leveraging legitimate system binaries for malicious network communication, potentially associated with malware like Raspberry Robin.
Detects the execution of 'rundll32.exe' when its parent process is 'explorer.exe'. This behavior has been observed in variants of the Raspberry Robin malware, as initially reported by Red Canary. The rule includes filters to reduce false positives from legitimate Windows operations, such as volume control.
Page 2 of 2