Uncommon Child Process Of BgInfo.EXE

 1title: Uncommon Child Process Of BgInfo.EXE
 2id: aaf46cdc-934e-4284-b329-34aa701e3771
 3related:
 4    - id: 811f459f-9231-45d4-959a-0266c6311987
 5      type: similar
 6status: test
 7description: Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
 8references:
 9    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
10    - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
11author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community
12date: 2019-10-26
13modified: 2023-08-16
14tags:
15    - attack.execution
16    - attack.t1059.005
17    - attack.defense-evasion
18    - attack.t1218
19    - attack.t1202
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection:
25        ParentImage|endswith:
26            - '\bginfo.exe'
27            - '\bginfo64.exe'
28    condition: selection
29falsepositives:
30    - Unknown
31level: medium

References

• Bginfo on LOLBAS

  

  Bginfo.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.

  
  Read More

• Bypassing Application Whitelisting with BGInfo

  

  TL;DR BGinfo.exe older than version 4.22 can be used to bypass application whitelisting using vbscript inside a bgi file. This can run directly from a webdav server. UPDATE: 22.05.2017 AppLocker is…

  
  Read More

Related rules

• Suspicious Child Process Of BgInfo.EXE
• HTML Help HH.EXE Suspicious Child Process
• Potential Arbitrary File Download Via Cmdl32.EXE
• Potential Binary Impersonating Sysinternals Tools
• Suspicious HH.EXE Execution