Windows Process: Raspberry Robin initial execution via cmd.exe launching msiexec from external media

title: "Windows Process: Raspberry Robin initial execution via cmd.exe launching msiexec from external media"
id: f86c19ed-23a0-49ed-baac-89e1b743dc38
related:
  - id: d52d2e87-eb03-4fac-961d-eb616da79788
    type: similar
  - id: 2c6bea3a-ef58-4f2e-a775-4928f6b7c58a
    type: derived
status: test
description: This rule identifies an initial execution pattern consistent with Raspberry Robin running from an external drive on Windows. It matches cmd.exe parent processes whose command line includes /r and ends with file extensions associated with external artifacts (.bin, .ico, .lnk, .lo, .sv, .usb), followed by msiexec.exe with quiet mode (/q) and an HTTP or HTTPS URL in the child command line. The detection relies on Windows process creation telemetry, specifically parent and child image paths and command-line arguments.
references:
  - https://redcanary.com/blog/raspberry-robin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_external_drive_exec.yml
author: "@kostastsale, Huntrule Team"
date: 2022-05-06
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \cmd.exe
    ParentCommandLine|contains: /r
    ParentCommandLine|endswith:
      - .bin
      - .ico
      - .lnk
      - .lo
      - .sv
      - .usb
  selection_child_img:
    Image|endswith: \msiexec.exe
    CommandLine|contains|windash: /q
  selection_child_http:
    CommandLine|contains:
      - "http:"
      - "https:"
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1