Suspicious New BgInfo.EXE Custom DB Path Registry Configuration (via registry_set)

This rule detects setting of a new registry database value related to BgInfo configuration. Adversaries can for example set this value to save the results of the commands executed by BgInfo to exfiltrate information.

SigmamediumWindowsv1

sigma

suspicious-new-bginfo-exe-custom-db-path-registry-configuration-via-registry-set

title: Suspicious New BgInfo.EXE Custom DB Path Registry Configuration (via registry_set)
id: b6b823b2-db1a-5afa-ab23-0c2c93609a22
status: stable
description: This rule detects setting of a new registry database value related to BgInfo configuration. Adversaries can for example set this value to save the results of the commands executed by BgInfo to exfiltrate information.
references:
    - https://attack.mitre.org/techniques/T1112/
    - Internal Research
author: Huntrule Team
date: 2026-03-18
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\Winternals\BGInfo\Database'
    condition: selection
falsepositives:
    - Unknown
level: medium

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.