Uncommon Child Process Of BgInfo.EXE

calendar Aug 18, 2023 · attack.execution attack.t1059.005 attack.defense_evasion attack.t1218 attack.t1202  ·
Share on: linkedin copy

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Sigma rule (View on GitHub)

 1title: Uncommon Child Process Of BgInfo.EXE
 2id: aaf46cdc-934e-4284-b329-34aa701e3771
 3related:
 4    - id: 811f459f-9231-45d4-959a-0266c6311987
 5      type: similar
 6status: test
 7description: Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
 8references:
 9    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
10    - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
11author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community
12date: 2019/10/26
13modified: 2023/08/16
14tags:
15    - attack.execution
16    - attack.t1059.005
17    - attack.defense_evasion
18    - attack.t1218
19    - attack.t1202
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection:
25        ParentImage|endswith:
26            - '\bginfo.exe'
27            - '\bginfo64.exe'
28    condition: selection
29falsepositives:
30    - Unknown
31level: medium

References

Related rules

to-top