Uncommon Child Process Of BgInfo.EXE

Title: Uncommon Child Process Of BgInfo.EXE
Status: test
Description:Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
References:
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
  -https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
Author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community
Date: 2019-10-26
modified:2023-08-16
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.005'
• -'attack.t1218'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith:
      -'\bginfo.exe'
      -'\bginfo64.exe'

  condition:selection
Falsepositives:
  -Unknown
Level: medium