Title:New BgInfo.EXE Custom DB Path Registry Configuration Status:test Description:Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information. References: -Internal Research Author: Nasreddine Bencherchali (Nextron Systems) Date: 2023-08-16 modified:None Tags:
-'attack.persistence'
-'attack.defense-impairment'
-'attack.t1112'
Logsource:
category: registry_set
product: windows
Detection: selection: TargetObject|endswith:
'\Software\Winternals\BGInfo\Database' condition:selection Falsepositives:
-Legitimate use of external DB to save the results Level:medium
