Suspicious Child Processes Spawned by BgInfo.exe on Windows

title: Suspicious Child Processes Spawned by BgInfo.exe on Windows
id: 62e3c510-099e-4406-b3a8-993c9bfb2a5f
related:
  - id: aaf46cdc-934e-4284-b329-34aa701e3771
    type: similar
  - id: 811f459f-9231-45d4-959a-0266c6311987
    type: derived
status: test
description: This rule flags Windows process creation events where BgInfo.exe/BgInfo64.exe launches child processes matching a set of scripting, command, or utility binaries, or where child execution occurs from common user and temp directories. Abnormal child spawning from BgInfo.exe can indicate attackers using it to proxy or stage execution through external scripts or command interpreters. Telemetry relies on process creation logs containing ParentImage and Image paths (including path endings/contains).
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
  - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-16
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \bginfo.exe
      - \bginfo64.exe
  selection_child:
    - Image|endswith:
        - \calc.exe
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \notepad.exe
        - \powershell.exe
        - \pwsh.exe
        - \wscript.exe
    - Image|contains:
        - \AppData\Local\
        - \AppData\Roaming\
        - :\Users\Public\
        - :\Temp\
        - :\Windows\Temp\
        - :\PerfLogs\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1