Sigma rule: Potential Raspberry Robin CPL Execution Activity

Rule

Title

Potential Raspberry Robin CPL Execution Activity

Status

test

Level

high

Author

Swachchhanda Shrawan Poudel

Date

2024-03-07

File

rules-emerging-threats/2024/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_rundll32_shell32_cpl_exection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function.
This behavior was observed in multiple Raspberry-Robin variants.

Log source

product

windows

category

process_creation

Detection

# Example: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\xxxx\AppData\Local\Temp\xxxx.CPL"
selection_parent_img:
    ParentImage|endswith:
        - '\rundll32.exe'
        - '\control.exe'
selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'
selection_cli:
    CommandLine|contains|all:
        - 'shell32.dll'
        - 'Control_RunDLL'
        - '.CPL'
selection_path:
    CommandLine|contains: '\AppData\Local\Temp\'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.stealth
• attack.t1218.011
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1218.011

References

• https://tria.ge/240226-fhbe7sdc39/behavioral1
• https://bazaar.abuse.ch/browse/signature/RaspberryRobin/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2024/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_rundll32_shell32_cpl_exection.yml