Suspicious Child Process Creation from BgInfo.EXE on Windows

Alerts when BgInfo.exe spawns suspicious calc/cmd/cscript/mshta/powershell/wscript or runs from common AppData/Temp paths.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-08-16
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.005Visual Basic
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where BgInfo.exe or BgInfo64.exe spawns specific child processes such as command interpreters and scripting tools. This behavior can indicate abuse of BgInfo for proxy execution to launch additional binaries or scripts. The detection relies on process creation telemetry that includes parent image and child image paths/names.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows: Uncommon Child Processes Spawned by Bginfo.exe

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows: Suspicious Child Process Spawned by VsCode code.exe

Windows WSL Process Spawning Uncommon Child Executables

Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution

Suspicious Child Process Creation from BgInfo.EXE on Windows

Pivot detection · T1202 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-child-processes-spawned-by-bginfo-exe-on-windows-811f459f

title: Suspicious Child Process Creation from BgInfo.EXE on Windows
id: 62e3c510-099e-4406-b3a8-993c9bfb2a5f
related:
  - id: aaf46cdc-934e-4284-b329-34aa701e3771
    type: similar
  - id: 811f459f-9231-45d4-959a-0266c6311987
    type: derived
status: test
description: This rule flags Windows process creation events where BgInfo.exe or BgInfo64.exe spawns specific child processes such as command interpreters and scripting tools. This behavior can indicate abuse of BgInfo for proxy execution to launch additional binaries or scripts. The detection relies on process creation telemetry that includes parent image and child image paths/names.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
  - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-16
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.005
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \bginfo.exe
      - \bginfo64.exe
  selection_child:
    - Image|endswith:
        - \calc.exe
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \notepad.exe
        - \powershell.exe
        - \pwsh.exe
        - \wscript.exe
    - Image|contains:
        - \AppData\Local\
        - \AppData\Roaming\
        - :\Users\Public\
        - :\Temp\
        - :\Windows\Temp\
        - :\PerfLogs\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL