huntrule

Windows: Raspberry Robin Command Execution via fodhelper, rundll32 and regsvr32

Flags Windows process-spawn chains where fodhelper.exe runs rundll32/regsvr32 with Raspberry Robin-style command-line patterns.

FreeUnreviewedSigmahighv1
title: "Windows: Raspberry Robin Command Execution via fodhelper, rundll32 and regsvr32"
id: 7bf514a7-4948-402a-a502-aa7a7e3a6fce
related:
  - id: 2c6bea3a-ef58-4f2e-a775-4928f6b7c58a
    type: similar
  - id: d52d2e87-eb03-4fac-961d-eb616da79788
    type: derived
status: test
description: This rule identifies suspicious Windows process executions consistent with Raspberry Robin activity, where a parent process ending in fodhelper.exe launches rundll32.exe or regsvr32.exe. It matches specific command-line characteristics including usage of odbcconf.exe, registry-related regsvr elements, and rundll32 shellexec parameters, along with additional driver/filename-related keywords and trailing switches. Telemetry required is process creation events with parent image, child image, and full command line.
references:
  - https://redcanary.com/blog/raspberry-robin/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-05-06
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \fodhelper.exe
    Image|endswith:
      - \rundll32.exe
      - \regsvr32.exe
    CommandLine|contains|all:
      - odbcconf.exe
      - regsvr
      - shellexec_rundll
    CommandLine|contains:
      - installdriver
      - setfiledsndir
      - vkipdse
    CommandLine|endswith|windash:
      - /a
      - /f
      - /s
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies suspicious Windows process executions consistent with Raspberry Robin activity, where a parent process ending in fodhelper.exe launches rundll32.exe or regsvr32.exe. It matches specific command-line characteristics including usage of odbcconf.exe, registry-related regsvr elements, and rundll32 shellexec parameters, along with additional driver/filename-related keywords and trailing switches. Telemetry required is process creation events with parent image, child image, and full command line.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.