Rule Info
Name
Potential Raspberry Robin Registry Set Internet Settings ZoneMap
Author
Swachchhanda Shrawan Poudel
Description
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024.
Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Reference
Date
2024-07-31 00:00:00
Modified
None
Id
16a4c7b3-4681-49d0-8d58-3e9b796dcb43
Tags
detection.emerging-threats attack.t1112 attack.defense-evasion DEMO
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR