Raspberry Robin Subsequent Execution of Commands via Fodhelper
This rule detects the subsequent execution of commands associated with Raspberry Robin malware. Specifically, it looks for processes where 'fodhelper.exe' is the parent process, and the child process is either 'rundll32.exe' or 'regsvr32.exe'. Additionally, the command line of the child process must contain specific strings like 'odbcconf.exe', 'regsvr', 'shellexec_rundll', and other keywords such as 'installdriver', 'setfiledsndir', or 'vkipdse', combined with specific command-line switches like '/a', '/f', or '/s'. This combination of parent-child processes and command-line arguments is indicative of Raspberry Robin's post-exploitation activities, often involving the abuse of legitimate Windows utilities for defense evasion and execution.
Sigma
