New BgInfo.EXE Custom WMI Query Registry Configuration

Title: New BgInfo.EXE Custom WMI Query Registry Configuration
Status: test
Description:Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-16
modified:None
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\Software\Winternals\BGInfo\UserFields\'
    Details|startswith: '6'
  condition:selection
Falsepositives:
  -Legitimate WMI query
Level: medium