New BgInfo.EXE Custom VBScript Registry Configuration

 1title: New BgInfo.EXE Custom VBScript Registry Configuration
 2id: 992dd79f-dde8-4bb0-9085-6350ba97cfb3
 3related:
 4    - id: cd277474-5c52-4423-a52b-ac2d7969902f
 5      type: similar
 6status: test
 7description: Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"
 8references:
 9    - Internal Research
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2023-08-16
12tags:
13    - attack.defense-evasion
14    - attack.t1112
15logsource:
16    category: registry_set
17    product: windows
18detection:
19    selection:
20        EventType: SetValue
21        TargetObject|contains: '\Software\Winternals\BGInfo\UserFields\'
22        Details|startswith: '4' # WMI
23    condition: selection
24falsepositives:
25    - Legitimate VBScript
26level: medium