blue tangle

  Raspberry Robin aka "QNAP Worm" is a suspected pay-per-install malware botnet linked to threat actor DEV-0856. Raspberry Robin spreads through infected USB, users click a .lnk file on the USB and from there msiexec.exe grabs a remotely hosted .msi file and quietly installs it, which is the next stage of the Raspberry Robin payload. One of the interesting things about Raspberry Robin is that it uses a very distinctive, low effort, form of command line obfuscation, mixed case (or "alternating caps"). You can see what that looks like below, from what looks like a Defender detection in the attached screenshot.     I wanted to come up with a way to detect mixed case obfuscation in Splunk, you can see what I came up with below:   index=winlogs EventCode=4688 Creator_Process_Name=*\\cmd. exe | rex field=Process_Command_Line max_match=0 "(?<upper>[A-Z])" | rex field=Process_Command_Line max_match=0 "(?<lower>[a-z])" | eval count_upper=m