Keith

@kwm

We now know a good bit about Raspberry Robin, including its potential association with a number of known threat groups.

We don't yet know how the USB component propagates, reference this brief discussion:

https://twitter.com/dyn___/status/1553007771053748225

8/3/2022, 3:12:37 PM

Favs: 6

Retweets: 0

Keith

@kwm

@MsftSecIntel @redcanary Here’s a clear depiction of a typical Raspberry Robin infection, which leverages these @MITREattack techniques (credit: @LaurenLeigh522)

T1059.003 https://attack.mitre.org/techniques/T1059/003/

T1218.007 https://attack.mitre.org/techniques/T1218/007/

T1218.008 https://attack.mitre.org/techniques/T1218/008/

T1218.011 https://attack.mitre.org/techniques/T1218/011/

8/3/2022, 2:01:33 PM

Favs: 8

Retweets: 1

Keith

@kwm

@MsftSecIntel @redcanary @MITREattack @LaurenLeigh522 Some Atomic Red Team tests to aid in detection of Raspberry Robin following introduction of an infected USB device (h/t @burning_pm)

T1059.003 https://atomicredteam.io/execution/T1059.003/#atomic-test-5---command-prompt-read-contents-from-cmd-file-and-execute

T1218.007 https://atomicredteam.io/defense-evasion/T1218.007/#atomic-test-11---msiexecexe---execute-remote-msi-file

T1218.008 https://atomicredteam.io/defense-evasion/T1218.008/#atomic-test-1---odbcconfexe---execute-arbitrary-dll

T1218.011 https://atomicredteam.io/defense-evasion/T1218.011/#atomic-test-1---rundll32-execute-javascript-remote-payload-with-getobject

8/3/2022, 3:08:28 PM

Favs: 11

Retweets: 0