Raspberry Robin Related Rules

rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml

@@ -6,7 +6,7 @@ description: |
     Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
 author: frack113
 date: 2022/01/16
-modified: 2022/10/23
+modified: 2022/10/28
 references:
     - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
@@ -15,21 +15,25 @@ logsource:
     category: process_creation
     product: windows
 detection:
-    selection_msi:
-        Image|endswith: '\msiexec.exe'
+    selection_img:
+        - Image|endswith: '\msiexec.exe'
+        - OriginalFileName: 'msiexec.exe'
+    selection_cli:
+        # Note that there is no space before and after the arguments because it's possible to write a commandline as such
+        # Example: msiexec -q/i [MSI Package]
         CommandLine|contains:
-            - ' /i'
-            - ' -i'
-            - ' /package'
-            - ' -package'
-            - ' /a'
-            - ' -a'
-            - ' /j'
-            - ' -j'
+            - '/i'
+            - '-i'
+            - '/package'
+            - '-package'
+            - '/a'
+            - '-a'
+            - '/j'
+            - '-j'
     selection_quiet:
         CommandLine|contains:
-            - ' /q'
-            - ' -q'
+            - '/q'
+            - '-q'
     condition: all of selection_*
 falsepositives:
     - Legitimate script

rules/windows/process_creation/proc_creation_win_msiexec_install_remote.yml

@@ -0,0 +1,44 @@
+title: Suspicious Msiexec Quiet Install From Remote Location
+id: 8150732a-0c9d-4a99-82b9-9efb9b90c40c
+related:
+    - id: f7b5f842-a6af-4da5-9e95-e32478f3cd2f
+      type: similar
+status: experimental
+description: Detects usage of Msiexec.exe to install packages hosted remotely quietly
+author: Nasreddine Bencherchali
+date: 2022/10/28
+references:
+    - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_img:
+        - Image|endswith: '\msiexec.exe'
+        - OriginalFileName: 'msiexec.exe'
+    selection_cli:
+        # Note that there is no space before and after the arguments because it's possible to write a commandline as such
+        # Example: msiexec -q/i [MSI Package]
+        CommandLine|contains:
+            - '/i'
+            - '-i'
+            - '/package'
+            - '-package'
+            - '/a'
+            - '-a'
+            - '/j'
+            - '-j'
+    selection_quiet:
+        CommandLine|contains:
+            - '/q'
+            - '-q'
+    selection_remote:
+        - 'http'
+        - '\\\\'
+    condition: all of selection_*
+falsepositives:
+    - Unknown
+level: medium
+tags:
+    - attack.defense_evasion
+    - attack.t1218.007

rules/windows/process_creation/proc_creation_win_raspberry_robin_single_dot_ending_file.yml

@@ -0,0 +1,23 @@
+title: Raspberry Robin Dot Ending File
+id: a35c97c8-d9c4-4c89-a3e7-533dc0bcb73a
+status: experimental
+description: Detects commandline containing reference to files ending with a ".". This scheme has been seen used by raspberry-robin
+author: Nasreddine Bencherchali
+references:
+    - https://twitter.com/MichalKoczwara/status/1553634816016498688
+date: 2022/10/28
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        CommandLine|re: "\\.[a-zA-Z0-9]{1,6}\\.[ |\"|']{0,1}"
+    filter:
+        # This filter is used to exclude double extension files
+        CommandLine|re: "\\.[a-zA-Z0-9]{1,6}\\.[a-zA-Z0-9]{1}"
+    condition: selection and not filter
+falsepositives:
+    - Unknown
+level: medium
+tags:
+    - attack.execution

rules/windows/process_creation/proc_creation_win_susp_shellexec_rundll_usage.yml

@@ -1,27 +1,31 @@
-title: Suspicious Usage Of ShellExec_rundll
+title: Suspicious Usage Of ShellExec_RundDLL
 id: d87bd452-6da1-456e-8155-7dc988157b7d
-description: Detects suspicious usage of the ShellExec_rundll function to launch other commands as seen in the the raspberry-robin attack
+description: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack
 status: experimental
 references:
     - https://redcanary.com/blog/raspberry-robin/
+    - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
 author: Nasreddine Bencherchali
 date: 2022/09/01
+modified: 2022/10/28
 logsource:
     category: process_creation
     product: windows
 detection:
     selection_openasrundll:
-        CommandLine|contains: ',ShellExec_rundll'
+        CommandLine|contains: 'ShellExec_RunDLL'
     selection_suspcli:
         CommandLine|contains:
             # Add more LOLBINs and Susp Paths
             - 'regsvr32'
-            - 'C:\Users\Public\'
+            - 'msiexec'
+            - '\Users\Public\'
             - 'odbcconf'
             - '\Desktop\'
+            - '\Temp\'
     condition: all of selection_*
 falsepositives:
     - Unknown
-level: medium
+level: high
 tags:
     - attack.defense_evasion