hightestEmerging Threat
Raspberry Robin Subsequent Execution of Commands
Detects raspberry robin subsequent execution of commands.
windowsprocess_creation
2022-05-06
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
hightestEmerging Threat
Raspberry Robin Initial Execution From External Drive
Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".
windowsprocess_creation
2022-05-06
hightestEmerging Threat
Potential Raspberry Robin Dot Ending File
Detects commandline containing reference to files ending with a "." This scheme has been seen used by raspberry-robin
windowsprocess_creation
2023-02-05
hightestEmerging Threat
Potential Raspberry Robin Aclui Dll SideLoading
Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.
windowsimage_load
2024-07-31
hightestEmerging Threat
Potential Raspberry Robin CPL Execution Activity
Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function. This behavior was observed in multiple Raspberry-Robin variants.
windowsprocess_creation
2024-03-07