Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload

Flags cmd.exe with /r from external media launching msiexec.exe /q that includes an HTTP/HTTPS payload URL.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2022-05-06
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies initial execution attempts consistent with Raspberry Robin malware running from an external drive by looking for a cmd.exe parent process. It matches cmd.exe with a command line containing '/r' and ending with external-asset extensions (such as .bin, .ico, .lnk, .lo, .sv, or .usb), then a child msiexec.exe using /q. It further requires HTTP/HTTPS URLs in the child command line, relying on Windows process creation telemetry including parent/child image paths and command-line arguments.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)

Suspicious Hidden PowerShell Spawned by Script Host via process_creation

Suspicious Run Key Persistence Referencing PowerShell Script via registry_set

Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)

Suspicious XOR Obfuscated PowerShell from ClickFix Distribution

Suspicious Hidden PowerShell Web Download via ClickFix Tactic

Malicious MS-SQL Server Spawning Command Shell via Mallox

Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-raspberry-robin-initial-execution-via-cmd-exe-launching-msiexec--2c6bea3a

title: Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload
id: f86c19ed-23a0-49ed-baac-89e1b743dc38
related:
  - id: d52d2e87-eb03-4fac-961d-eb616da79788
    type: similar
  - id: 2c6bea3a-ef58-4f2e-a775-4928f6b7c58a
    type: derived
status: test
description: This rule identifies initial execution attempts consistent with Raspberry Robin malware running from an external drive by looking for a cmd.exe parent process. It matches cmd.exe with a command line containing '/r' and ending with external-asset extensions (such as .bin, .ico, .lnk, .lo, .sv, or .usb), then a child msiexec.exe using /q. It further requires HTTP/HTTPS URLs in the child command line, relying on Windows process creation telemetry including parent/child image paths and command-line arguments.
references:
  - https://redcanary.com/blog/raspberry-robin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_external_drive_exec.yml
author: "@kostastsale, Huntrule Team"
date: 2022-05-06
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \cmd.exe
    ParentCommandLine|contains: /r
    ParentCommandLine|endswith:
      - .bin
      - .ico
      - .lnk
      - .lo
      - .sv
      - .usb
  selection_child_img:
    Image|endswith: \msiexec.exe
    CommandLine|contains|windash: /q
  selection_child_http:
    CommandLine|contains:
      - "http:"
      - "https:"
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL