Potential Raspberry Robin Registry Set Internet Settings ZoneMap

Description

Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.

Query · sigma

selection_registry_image:
- Image|contains:
  - \AppData\Local\Temp\
  - \Downloads\
  - \Users\Public\
  - \Windows\Temp\
- Image|endswith: \control.exe
selection_registry_object:
  TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
selection_value_enable:
  TargetObject|endswith:
  - \IntranetName
  - \ProxyByPass
  - \UNCAsIntranet
  Details|contains: DWORD (0x00000001)
selection_value_disable:
  TargetObject|endswith: \AutoDetect
  Details|contains: DWORD (0x00000000)
condition: all of selection_registry_* and 1 of selection_value_*

Known false positives

  • Unknown
Raw source Potential Raspberry Robin Registry Set Internet Settings ZoneMap · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Potential Raspberry Robin Registry Set Internet Settings ZoneMap
id: 16a4c7b3-4681-49d0-8d58-3e9b796dcb43
status: test
description: |
    Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024.
    Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
references:
    - https://tria.ge/240225-jlylpafb24/behavioral1/analog?main_event=Registry&op=SetValueKeyInt
    - https://tria.ge/240307-1hlldsfe7t/behavioral2/analog?main_event=Registry&op=SetValueKeyInt
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_ProxyByPass
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_IncludeUnspecifiedLocalSites
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect
    - https://bazaar.abuse.ch/browse/signature/RaspberryRobin/
author: Swachchhanda Shrawan Poudel
date: 2024-07-31
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
    definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" and its sub keys must be monitored'
detection:
    selection_registry_image:
        - Image|contains:
              - '\AppData\Local\Temp\'
              - '\Downloads\'
              - '\Users\Public\'
              - '\Windows\Temp\'
        - Image|endswith: '\control.exe'
    selection_registry_object:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\'
    selection_value_enable:
        TargetObject|endswith:
            - '\IntranetName'
            - '\ProxyByPass'
            - '\UNCAsIntranet'
        Details|contains: 'DWORD (0x00000001)'
    selection_value_disable:
        TargetObject|endswith: '\AutoDetect'
        Details|contains: 'DWORD (0x00000000)'
    condition: all of selection_registry_* and 1 of selection_value_*
falsepositives:
    - Unknown
# Note: can be upgraded to medium after an initial baseline
level: low

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.