Raspberry Robin Initial Execution From External Drive

Status: test
Severity: high
Log source: category process_creation, product windows
Author: @kostastsale
Source: github.com/SigmaHQ/sigma

Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Raspberry Robin Initial Execution From External Drive
id: 2c6bea3a-ef58-4f2e-a775-4928f6b7c58a
related:
    - id: d52d2e87-eb03-4fac-961d-eb616da79788
      type: similar
status: test
description: Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".
references:
    - https://redcanary.com/blog/raspberry-robin/
author: '@kostastsale'
date: 2022-05-06
tags:
    - attack.execution
    - attack.t1059.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains: '/r'
        ParentCommandLine|endswith:
            - '.bin'
            - '.ico'
            - '.lnk'
            - '.lo'
            - '.sv'
            - '.usb'
    selection_child_img:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains|windash: '/q'
    selection_child_http:
        CommandLine|contains:
            - 'http:'
            - 'https:'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|endswith: '\cmd.exe'
    ParentCommandLine|contains: '/r'
    ParentCommandLine|endswith:
        - '.bin'
        - '.ico'
        - '.lnk'
        - '.lo'
        - '.sv'
        - '.usb'

Stage 2: `selection_child_img`

selection_child_img:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains|windash: '/q'

Stage 3: `selection_child_http`

selection_child_http:
    CommandLine|contains:
        - 'http:'
        - 'https:'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/q` transforms: `windash` corpus 8 (sigma 7, splunk 1) `http:` corpus 5 (elastic 3, sigma 2) `https:` corpus 5 (elastic 3, sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\msiexec.exe` corpus 20 (sigma 20)	`field:"Image" kind:ends_with value:"\msiexec.exe"`
`ParentCommandLine`	ends_with	`.bin` `.ico` `.lnk` `.lo` `.sv` `.usb`	`field:"ParentCommandLine" kind:ends_with`
`ParentCommandLine`	match	`/r` corpus 2 (sigma 2)	`field:"ParentCommandLine" kind:match value:"/r"`
`ParentImage`	ends_with	`\cmd.exe` corpus 20 (sigma 20)	`field:"ParentImage" kind:ends_with value:"\cmd.exe"`

Raspberry Robin Initial Execution From External Drive

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_parent

Stage 2: selection_child_img

Stage 3: selection_child_http

Indicators

Stage 0: `condition`

Stage 1: `selection_parent`

Stage 2: `selection_child_img`

Stage 3: `selection_child_http`