Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload

Flags cmd.exe with /r from external media launching msiexec.exe /q that includes an HTTP/HTTPS payload URL.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2022-05-06
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies initial execution attempts consistent with Raspberry Robin malware running from an external drive by looking for a cmd.exe parent process. It matches cmd.exe with a command line containing '/r' and ending with external-asset extensions (such as .bin, .ico, .lnk, .lo, .sv, or .usb), then a child msiexec.exe using /q. It further requires HTTP/HTTPS URLs in the child command line, relying on Windows process creation telemetry including parent/child image paths and command-line arguments.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

Suspicious Script Download via Curl and PowerShell by Dohdoor

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-raspberry-robin-initial-execution-via-cmd-exe-launching-msiexec--2c6bea3a

title: Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload
id: f86c19ed-23a0-49ed-baac-89e1b743dc38
related:
  - id: d52d2e87-eb03-4fac-961d-eb616da79788
    type: similar
  - id: 2c6bea3a-ef58-4f2e-a775-4928f6b7c58a
    type: derived
status: test
description: This rule identifies initial execution attempts consistent with Raspberry Robin malware running from an external drive by looking for a cmd.exe parent process. It matches cmd.exe with a command line containing '/r' and ending with external-asset extensions (such as .bin, .ico, .lnk, .lo, .sv, or .usb), then a child msiexec.exe using /q. It further requires HTTP/HTTPS URLs in the child command line, relying on Windows process creation telemetry including parent/child image paths and command-line arguments.
references:
  - https://redcanary.com/blog/raspberry-robin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_external_drive_exec.yml
author: "@kostastsale, Huntrule Team"
date: 2022-05-06
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \cmd.exe
    ParentCommandLine|contains: /r
    ParentCommandLine|endswith:
      - .bin
      - .ico
      - .lnk
      - .lo
      - .sv
      - .usb
  selection_child_img:
    Image|endswith: \msiexec.exe
    CommandLine|contains|windash: /q
  selection_child_http:
    CommandLine|contains:
      - "http:"
      - "https:"
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL